fixed credential handling for box downloads