A file download can be triggered in two ways: using the file manager widget, or using the download file activity in a microflow. I guess you are using the latter, what could explain IE7 and IE8 asking for permission.
When a download is triggered by microflow, the server tells the client to download a file. Because IE does not know this download has anything to do with the user clicking on a microflow button, IE gets suspicious and will ask for permission. This is a good thing really. Unfortunately, IE will need to reload the entire page with the new permissions when they change.
To avoid IE getting suspicious, the file manager widget could be used. Now IE will recognize the file download being initiated by the user, and will not ask for permission. The downside of this approach is that the file should already exist so you probably would have to split up the file creation and file download.