Ok I've found the problem.  :)  And I've got a hack to work around it until I fix it correctly.

The problem is that the method PortalSecurity.isInRole is looking for a role name and the Gallery module is passing it the ID of the role name.

The quick fix is this:

Create a role (I'll call it DownloadPhoto) and from the Gallery configuration screen add this role as one of the authorized download roles.

Find the moduleID of the Gallery module.  You can find this in the Modules table on the database. (Select moduleid from dbo.Modules where ModuleTitle = 'Gallery') Change that if your moduletitle is different.

In the ModuleSettings table find the row with your moduleID and SettingName = DownloadRoles.

This will have the ID of the role you just gave download permissions to (in my case it looks like ;3).  Change the number to the name of the role.

Flush your cache as host and then try it out with a user that only has that role.  It should work.

Unfortunatly this will break the configuration screen.  The control that gets populated with the download roles is looking for an id number.  So make sure you have the configuration working the way you want to first.  If you need to get back in to the configuration settings reverse the DB changes.  

You create a role as the admin user under the admin menu item security roles.

Then go into the Gallery configuration screen and add that roll to the downloads roll.

Once you've done that if you want it to work follow my previous post.  :)

Cheers,