If you expect visitors to ask before downloading your content, making it simply fetchable with HTTPS on the open Internet is a bad way of implementing that requirement.

You need an actual workflow where the visitor has to initiate asking, and then wait for the request to be reviewed and granted.