User/File Management, downloadable files are session bound and .htaccess protected against hot-linking.
Users are not wp users. Files are displayed in a jQuery powered filetree.
Now with public download area, public downloads are not session bound.
You can even tell wp which subdirectory of the public folder should be used as root-directory.