The file edit is NOT guaranteed to work, however it did stop the immediate downloading of files without a token on my dev site.
Open /includes/class.file.php
Find:
// remove session
if (isset($_SESSION['showDownload']))
{
	$clearSession = true;
	// fixes android snag which requests files...