hook_file_dowload() randomly thinks user is anonymous
Solution is insuring all site urls use the same subdomain, either including the www before the domain or not including the www before the site domain. Plus within .htaccess forcing all user urls to reference the site via that same subdomain qualifier. 

The problem was inconsistent use of www and nothing as the site's subdomain.