Avoid using deprecated function.
Avoiding double-free of the BIO structure (SSL_free should already free it).
Slight reordering of the function arguments in download() to avoid back and forth conversion of Url<->string.