escape download handler URLs
esc_url_raw to readfile home_url()
esc_url applied to readfile home_url()

This should fix it.

Thank you Mike for the info on esc_html.
Merge pull request #4214 from toddlahman/master

escape download handler URLs