switch to registration via POST

- download relevant data is sent per POST, a token is received
- download is started by GET and the received token
- solves the disadvantages from XHR-only download
- job to cleanup download tokens

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>