People are going to download the file by referencing its filename indirectly (using it upload date in epoch seconds): i.e. get.cgi?id=xxxxxxx

The server then takes it's id, looks up it's proper filename in a DB, then sends the file to the browser.

Here's the relevant part of my download script:

open(DLFILE, "<$file_location/$id") || Error('open', 'file');
@fileholder = <DLFILE>;
close (DLFILE) || Error ('close', 'file');

print "Content-Type:application/x-download\n";
print "Content-Disposition:attachment;filename=@filename[0]\n\n";
print @fileholder
[download]