I\'m using forced download to download mostly zips and mp3s on site i did (http://pr1pad.kissyour.net) - to track downloads in google analytics, in database and to hide real
Just a shot in the dark... every header that I send in my 'force download' code (which is not as well tested as yours) is the same as yours, except I call:
header("Cache-Control: private",false);