[Hellcat]

I have a script that does almost what you described - except for the logged in to vB thing (it checks an own login).

If it would help you I could just send you that script so you can "walk" through it and see how it does what.
IMHO that's always the best way to get such questions answered.

But a short one anyways
If you want to send a file, rather then a HTML page, you could use this block of code BEFORE you output anything else:

header ( "Content-Type: application/octet-stream");  // or whatever mime-type is appropriate
header ( "Content-Length: ".$filesize);  // filesize in bytes!
header ( "Content-Disposition: attachment; filename=\"$filename\"");
readfile($filepath);