Nice plugin, great job - very handy.
You should possibly consider integrating it with a plugin something like http://wordpress.org/extend/plugins/relocate-upload/ - would be very powerful and cool, to be able to password protect automatically just some folders.
I had a nightmare with files paths with this plugin though, not sure if it's my server set or what.
The main reason that I wanted to write is that you should add the Status Code header of:
header("HTTP/1.0 200 OK");
to successful downloads.
Otherwise, according to my environment, a 404 status code is still returned even when the document is sent back to the browser successfully (ie. once logged in).