Clarify tarball redirects and access tokens