for using it with lighttpd add this to the virtual host url.rewrite += ( "^/tl_files/(.*)" => "download.php", )
Download wrapper for contao, can be used to check permission (.htaccess) without apache webserver