Seems to me that you could use basic http authentication to protect your downloads area, restricting it to members only. a Google search for ".htaccess basic authentication" or something similar should yield ample resources.
Basically, it comes down to 2 apache configuration files: .htaccess and .htpasswd. When a user tries to access the directory that is "protected", Apache will use these files to prompt the user for userid/password and check that password against the one stored in the .htpasswd file.
As far as allowing for update of passwords, you can write (or have written) a very simple form and a php script to shell out and update the .htpasswd file (used above).
This is just about the simplest solution I can think of to accomplish what you describe. If you need help to implement (and have a few dollars), let me know.