Firebase Storage READ security rules: almost pointless, as currently implemented.

### Environment

* Operating System version: NodeJS
* Browser version: any
* Firebase SDK version: v8, v9
* Firebase Product: Storage

### The problem

So, Google Folk:

Would someone please tell me under what conditions would any *authenticated* rule *ever* be passed for reads in the Firebase client SDKs?

For Example:
```
//rules_version = '2';
service firebase.storage {
match /b/{bucket}/o {
match /aTopLevelStructure/{file=**} {
allow read: if request.auth != null;
}
}
```

It seems obvious enough - until you finally realize that the client SDK's failed to implement the (extremely obvious) .get() method on a storage reference.

```.getDownloadURL()``` creates a TOKENIZED URL, which BYPASSES the above security rules.

Use of an UNtokenized URL in a browser context (such as an image URL) DOES NOT INCLUDE authentication headers, so the above rule will ALWAYS fail.

*IF* there is no ```.get()``` method, and...
*IF*``` getDownloadURL()``` always generates a URL that bypasses the rule...

What the ever-loving-heck is the POINT of such a rule?

And PLEASE don't repeat the usual pushback of "once a URL is in the world what's the point of security" - I have very good reasons (which I can explain in confidence, out-of-band) why I want this level of control.

It's ALSO clear someone INTENDED there to be this level of control.

I can, of course, write a wrapper that some-way-or-another gets the authentication headers and add them to an HTTPS request (SPECIFICALLY WHAT YOUR CODE IS DOING ALREADY) to download an item (whether image or not) to the client JS...

But WHY would I do that when I can see that virtually ALL of the needed code ALREADY EXISTS in the SDK, you just didn't expose a ```.get()``` method...

so:
either some way to cause browser image fetches to include/use the cookie for authentication (is it a CORS policy?)
OR
just simply add the ```.get()``` method to StorageReference in the client SDK

(hey, put me on contract, I can probably get it done - I've already started poking in the repository, which is why I know most of the code structure is there)

#### Steps to reproduce:

- Create/upload/whatever an item in Firebase Cloud Storage
- create the rules, as above
- create the tokenized URL
- use that URL in browser
- All rules will be bypassed by the token.

(FYI, I am creating a @leaddreamer/firebase-wrapper library for my own use, which INCLUDES wrapper to make the client API almost identical between client and Admin SDK. Obviously the ```.get()``` is trivial in Cloud Storage. It doesn't help the browser, though)