Add a token to file download links

[rolandgeider]

At the moment the URLs that download files (workout PDF, etc.) check that the user is the owner of the object. This does break down when the application is "installed" and opened as an app. While there is code in the android app for this, a solution should be implemented that works for all devices (firefox OS, etc.). The easiest solution would be to add a token that is valid for x min. If it's possible to use django's token framework used for the password recovery, then we use that otherwise we roll out our own.