v1.4.2: require admin access for file pull API

This locks down the files "pull" API to require admin. Even though it's a read (GET), this meant any user could potentially read sensitive files.

Changelog since v1.4.1: v1.4.1...v1.4.2