Hi,
i'm not a guru but i try to replay at you...
When you create an ACCES POLICY (where you disable MIME TYPES) you connect this at a CONTENT FILTER, in this content filter there's white and black list, so i think, if you add in white list the download xen website (ex. download.xen.com), you or your client will be able to download all from xen... (never i try before...

)
I wait for replay... Regards.