Where are these features?

In your introductory text, you're talking about "if somebody wants to (...) download an attachment of the node, will be redirected to a password query". Now I installed the module and it's working well, but if I attach a file (PDF) to a node which is protected, the direct URL of the attached file (http://mysite.com/sites/default/files/test.pdf) can always be accessed without having to provide the password first. When accessing the node, the password is requested correctly. Did I miss something or have I misunderstood your documentation? Thanks in advance...