And the culprit was… my apache config. Please do not forget to edit the apache configuration in /etc/apache2/apache2.conf and add the lines
<Directory /var/www/html/>
AllowOverride All
</Directory>
I still have a question. It seems (but it may be related to the fact that the site is still in localhost) that this method does not prevent from downloading using curl for instance. Am I right?
Thanks.