core: Downloads with user/pass use curl -u flag [GH-3183]