I am having the exact same problem. Although User Access Manager hides pages, file links work for people that are not logged in. This is a pretty big security hole. I followed Samuel B’s advice and this helps, but it is not a complete solution. Converting2wp, have you found a fix?
