Allow to require hmac for downloads

[tmaier]

It would be great if one could configure in then host file that he requires hmac authorized requests when downloading a file.

Combined with #17

One could define two vhost entries:

https://storage.mycompany.com/myapp1/public Where hmac is not required for the downloads

And https://storage.mycompany.com/myapp1/private Where hmac is required for the downloads

Both vhost entries would need to share the same secret to allow a unified upload and hmac signing mechanism.

[choonkeat]

hmac for download is being proposed at #14; i'll take this as a :+1: for that

[darkhelmet]

This would be great for us as well. Looking through the code, I'm guessing it would basically be another rack middleware? I might look into this when we get to a point where we need it.