Form and gated content
You didn't mention whether you are using ctools modal forms or a custom modal form. 

For general form API submissions, the submit handler will only be executed when the form validation has passed, including the regular CSRF checks. 

Suppose you have a form like this:

&lt;?php
function my_form() {
  if (!empty($_COOKIE['Drupal_visitor_downloadbypass'])) {
    drupal_goto('download/able/file.here'); // rest of the page will not execute because drupal_goto ends the request. 
  }
  $form['example'] = ...;// your form building goes here
  ..
  ..

  return $form;
}

function my_form_submit($form, &amp;$form_state) {
  // $form_state['values']['example'] contains the submitted value of 'example' element. 
  user_cookie_save(array('downloadbypass' =&gt; 1));
  $form_state['redirect'] = 'download/able/file.here';
}


If you are using a ctools modals, you can check the $form_state in your ctools form builder to do the same cookie check and redirect above. 

Your ctools form builder can be as follows. Note the $form_state check. 

&lt;?php
function my_ctools_form_wrapper($js = NULL) {
  ctools_include('ajax');
  ctools_include('modal');
  $form_state = array(
    'ajax' =&gt; TRUE,
    'title' =&gt; t('My Ajax Form'),
  );

  $output = ctools_modal_form_wrapper('my_form', $form_state);

  if (!empty($form_state['executed'])) { // is the form submitted ?

    // Add the responder javascript, required by ctools
    ctools_add_js('ajax-responder');

    // Create ajax command array, dismiss the modal window.
    $output = array();
    $output[] = ctools_modal_command_dismiss();
    $output[] = ctools_ajax_command_reload();
  }

  print ajax_render($output);
  exit();
}