First off, if that really is your rcon password in the config file, change it on your server NOW!
The download URL you have set in the server config needs a trailing /. It is also open so that anyone can navigate to it using a browser, you might want to investigate securing it after you get downloads working.
The maps found at the URL need to be moved into a sub-folder named maps for them to download correctly to the client.
In other words, the structure located at the download URL needs to be the same as what you see when you are looking at the /orangebox/tf/ folder.
You only need to create folders that will explicitly have content that the client is directed to download. If you add downloadable sounds, you'll need a folder named sounds with probably a sub-folder (admin_sounds or quake for example). Some maps are now coming with pictures for the newer server browser window, they go into the materials/vgui/maps folder.