I will give you a PHP based download script which uses your session.php to check if the user has been authenticated, only then and then can the file be downloaded. This script mainly helps avoid direct file links. You can serve files from anywhere on your server
If you need another custom script i can provide that too. Please contact me