This means that if you use a username/password in url the users can see it, if you do not use a username/password in your url then they can grab the files, you then have to implement passwords on all the files. In my opinion the url should not be returned from the download function.
The url still shows when the download is complete for the lenght of time it takes to copy from the inet temp folder to the location specified in the download command.
I see. Well, thanks for pointing this out. For the time being I'd recommend using seperate dialogs for the download and install progress routines, with no progress field in the download dialog.