In the analysis app, I construct download URLs for data which are sent to the analytics celery worker. In order for these URLs to work for private data, I construct an item URL like this:

https://arbor.kitware.com/girder/api/v1/item/<itemid>/download&token=<user-token>

Inside the login callback seemed to be the only place to capture this information.