Protecting folders with downloadable files?

I've set up a secure area on our client's website where they have a few pages with links to downloadable files - mainly PDFs, all containing sensitive corporate information. I used SecurityAssist to set up the secure pages and have also set up PowerCMS on the pages so that they can upload the documents and update the pages themselves. The upload folder sits within the /secure directory. However, I have now discovered that if someone has a direct link to the PDF (i.e. www.mywebsite.com/secure/document.pdf), the file is not protected and can be downloaded by anyone. This is no good as the files are the things that they specifically want to protect.

I did see another post about this and I now know that SecurityAssist can only protect PHP pages - you suggested uploading PDFs to the root directory and then creating a download behaviour, but I don't think this will work for me as a) the root folder is write protected and b) since they are uploading the files themselves and creating links on the pages, how can they create a download behaviour themselves with only enough basic knowledge to operate a simple CMS?

My temporary workaround is to put a .htaccess file in the /uploads folder and then create the same usernames and passwords to access it, but this means that users have to login twice which isn't very practical. How can I achieve what I need to do?