Fixed authentication bug

When authenticating with Google for the download() function, was sending the oAuth token as both an HTTP header and QueryString element. Just sending HTTP 'Authorization' header now, as Google best practice document advises.