This commit moves some code out of UploadController#show_secure so it can be reused in other controllers if a secure upload needs to have permission checks run. Co-authored-by: Martin Brennan <martin@discourse.org>
