Links that include
www.pythonanywhere.com require you to be logged in in order to view them; if they did not, then anyone on the Internet could read your private files, which of course would be a bad idea.
Your website will only serve up files that you have explicitly configured it to serve, for the same reason -- if
http://xhero.pythonanywhere.com/mytext.txt automatically served up the page at
/home/xHero/mytext.txt, then it would be easy for hackers to break into your site by trying URLs like
http://xhero.pythonanywhere.com/mysite/myproject/settings.py in order to get your private database settings.
So, if you want your friend to access that file, you should put it into one of the directories that you have explicitly configured to serve static files. Alternatively, you could use the "Share" option in the file editor.