authenticated sharp users could download unrelated laravel storage objects through the generic download endpoint
it is easy tho