Oops I left out the most important part of the question:
response.sendRedirect(location) works as long as the temp file is somewhere under my /context, eg
https://hostname/myapp/temp/tempfile.zip
However, for security reasons I rather generate the temp files in either
a) java.io.tmpdir, (eg...