Comment 4 for bug 239209

Please feel free to ignore our comments about the additional login request when you download the document - we just realised that you have to have password protection as well as hiding the link, else someone can pass the link's URL to another person and they could download the document.

Hiding the DL link is only half of the security you need behind access controlled documents. Password protecting it is a perfectly sensible idea and of course it should behave like this.