download on non-SSL