Comment 1 for bug 39674

The problem is that currently all and any librarian content is publically available if you can figure out the filename. For 1.2.4 we will have a private librarian instance, but it will only be usable internally. The next step is allowing access-controlled downloads to that private librarian; this will eventually allow us to fix this bug.