Add access control to Django media folder

I don't think we should allow any person to download files from the media folder / persistence folder, specifically in the case of private experiments

Start by locating the Django configuration and request path serving the media or persistence folder. Determine how private experiments are identified and which users should be allowed to download their files. Done means unauthorized users cannot retrieve private files while permitted users still can, with coverage for both cases.

Written by the indexing model from the issue text.