Thanks @paul
I will test your suggestion.
However this isn't a perfect solution in terms of security because the
actual download link will be visible in the html page source code.
I guess I could have the checks in the observeEvent and downHandler, so that dummy content is exported if the hidden download link is "found and exploited."