Allow auth tokens via get parameter, download file set filename header