You don't need to put nofollow on any links which are perfectly trustworthy, It's not needed, there's no reason to try and sculpt your page rank if that's what your aiming for.
From SEOMoz and Matt Cutts
Does the Number of Outbound Links from a Page Affect PageRank?
For instance, to conserve "link juice" and/or funnel it more discretely, does it matter whether I have three outbound links versus
two? In the original PageRank formula, yes, juice flowed out in a
simple formula of Passable PR divided by number of outbound links. But
nowadays, Matt says it is a much more cyclical, iterative analysis
and, "it really doesn't make as much difference as people suspect."
There's no need to hoarde all of your link juice on your page and, in
fact, there may be benefit to generously linking out (not the least of
which is the link-building power of good will).
On the other hand are your trying to hide the download file from everyone but authorized users? If so you should be going about it another way using a script to initiate the download when the user is authorized.
If the file doesn't matter just link to it.