In the previous implementation, an unauthenticated user attempting to
download the archive repeatedly would interfere with authenticated
users. To avoid that, we increase the scope of the limiter to include
the user.