AndrewD, just thought I would give you some more information. It looks like the reason a user can get into the hidden category files is because of my cookies being on the same server. When I tried the test with george on a newly imaged server, the problem did not occur. So it looks like your download agreement logic is causing the probem.
I try to download a file for the first time as BeauBeau:
But your download Continue screen shifts me back to SSULibrarian - I don't know if this is because of cookies or the Remember Me option being "on":
Hope this helps.