Peter's answer will indeed solve the issue, but you should be careful, though, as using this will make any file in var/ available publicly, while they're usually downloaded using the content/download script.
If you have a known pattern for these files, you could limit the rewrite rule:
Why not changing the rewrite rules suggested in the documentation, to something more secure?
Also see http://ez.no/doc/ez_publish/technical_manual/4_x/installation/virtual_host_setup#comment17679
I'm pretty sure there is an issue about this also in the issue tracker, can't find it back though (might be because I don't see security issues anymore).
