We'll create fresh WordPress site with al3x_file_manager installed. You have 20 minutes to test the plugin after that site we'll be deleted.
User/File Management, downloadable files are session bound and .htaccess protected against hot-linking.
Users are not wp users. Files are displayed in a jQuery powered filetree.
Now with public download area, public downloads are not session bound.
You can even tell wp which subdirectory of the public folder should be used as root-directory.