For IP address restriction on download tokens, it can be enabled by following this guidance:
In /core/includes/file.class.php, change this:
// check token
// $tokenData = $db->getRow('SELECT id, user_id, ip_address, file_id, download_speed, max_threads FROM download_token WHERE file_id = ' ...