ext.php should be limited to files not requiring login.
We need to move user-specific functionality to a normal controller to check that we are serving a file from the proper user.

Security regression from #3433
Partial fix #4928