The easiest solution is to download it to a subdirectory of cgi-bin, and then remove access from that subdirectory using .htaccess.
Alternatively, you can use relative paths to access a directory outside of cgi-bin, but you'll of course have to set permissions right, which can be a challenge...