Fixed #33: sort by track position in album in API vy default, also reuse that information on frontend side

Fixed #15: Ensure we check for authorization for serving audio files, meaning we don't leak the absolute URL anymore