Generates a short-lived file token for accessing protected file(s).

The client must be superuser or auth record authenticated (aka. have regular authorization token sent with the request).