Set download attribute on Thabloid download links

Ghost User
2019-02-10T17:16:39+01:00

Setting the `download` attribute makes sure the browser downloads the file and does not load it into its own pdf reader. This is better because pdf readers of some browsers violate our content security policy.

This is also better for consistency, because other documents are downloaded as well (because Django sets the `Content-Disposition` header).