actually append access token to URI when downloading #1292