download: add flag to indicate whether hash should be required