Content Protection Annoyingly Inconsistent

Ok, so I've got downloadable media (PDFs) set up in a protected content group. Each PDF media file is assigned the correct group. The access level shortcodes wrapping the links to the PDFs are working correctly so that only subscribers can see the links. But the actual url where the PDF files are stored still work in a browser that is NOT logged in, i.e. Visitors. Who aren't supposed to see this content.
Now, this WAS working! A few different times in the set up of the site. So when I copy the link of the PDF and paste it in a non-loggin browser a "NO ACCESS" message and logo appear. So that was working just fine. Like this morning it was, then I was finishing up administrative email operations on the site. Just now, I've uploaded another PDF for Subscriber only download and noticed both PDF urls are accessable to whom ever can paste them in. This is unacceptable. Why is this so inconsistent?