TokenCredentials, DirectDownload: Rework cookie handling

That way we don't override QNAM's cookie jar behaviour