authenticated sharp users could download unrelated laravel storage objects through the generic download endpoint
one vulnerability. multiple targets. multiple certificates.
upsolved it tho :p
