In downloadCallback this.userId and this.user() always are/return null. If they do not work why are they in the Context?

Also, the same works in protected. What's the difference between protected and downloadCallback other than that? If it works in protected why is there downloadCallback and are there any side effects of using protected for download permissions?