Our handling of uploaded files (see FilesController#show_protected_upload) checks for the full file name including the file path. However, URLs generated by CarrierWave didn't contain any path information resulting in invalid URLs. The wrong behavior was only visible when serving native files was disabled in Rails (or by using the x_sendfile_header).
