I have password on my itunes why is it allowing my son to download

There is a default 15 minute period during which an account's password doesn't need re-entering - on an iOS device, depending upon the iOS version on it, you might have a Settings > General > Restrictions > Require Password setting which you can set to 'Immediately'. You can also log out of your account when not buying or downloading content.