One thing that needs to be done is to insure that all clients that you are testing this on are actually using the SWG as a proxy. Have the proxy settings on the client be set to the Gateway. If not then they will bypass the gateway and the file downloads will be successful.