server: return the blob stream with proper mime types
TODO:
- security headers for proper origin sandboxing
(users could store sensitive info + general namespace collisions bad)
- backfill and cdn to take load off of the main appview
this will populate a database which the appview does reads from
and will download any referenced routes (to a certain size per user)
and gc old routes