made internal.download() function more flexible

required by @mchacki
can now send custom headers and use non-GET method