Generating and downloading files with WP API

Plugins that load the WordPress environment this way get rejected from the repository, as they are prone to failure in non-standard configurations.

For something like this I would use the admin-post-$action to receive requests. The WordPress API will be available where you can check if users are authorized to perform specific actions.