Hacks to ensure we don't redirect with auth credential headers

Is this even useful?

Ie. if it's not json aren't the odds that we should be doing a download of a file instead... ie. for anything, but testing?