Hide Access Token

closes #3177
- uses an iFrame to initiate the download to hide the access token

The access token is hidden in the admin logic if this PR is merged. If we would like to
completely hide the token it is possible to remove the access token and
use signed requests instead, but I think the effort isn’t worth the
benefit in this case.