The reason files might appear to download is because they are actually just downloading the web page that says 'you don't have permission to access this' (when really it should have received the file byte stream if it had authenticated properly).

The reason I would guess that PNGs are working, is because the browser exhibits no problems viewing password-protected webpages (and therefore the files that are part of them, ie. pngs, which download properly).

Anyways,
Hopefully tech support will get this sorted because it is a real pain in the butt.