Jason, thank you for your help!!
Of course I thought of one other question: does the user need to have cookies enabled on their computer to enter the password or download the pdf file? What happens or what do they see on their computer if they have cookies disabled? I may need to put some text on the page to guide them what to do if they encounter a problem.