fixes #6289: avoids concurrent downloads of files with the same name and destination dir.

Another thought, maybe create it as a hidden file, e.g. `'.' + afile`.  httpd at least won't serve these by default, maybe TFTP daemons are the same?  (I'd have to check)