We do a bunch of iframe / js tricks to get the progress bar to work
and then rely on session for the file name to serve it at the end

This change just passes only the file name to the js redirect and then
rebuilds the full path on return. Because we use the user's id in full
path we can make sure only the valid logged in user can fetch the file

behatnotneeded

Change-Id: I6478df19465ad8e1075343cb40e6f5360061b56a
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>