The file edit is NOT guaranteed to work, however it did stop the immediate downloading of files without a token on my dev site.
Open /includes/class.file.php
Find:
// remove session
if (isset($_SESSION['showDownload']))
{
$clearSession = true;
// fixes android snag which requests files...