htaccess updates, getting download/ to go secure