With server tokens attached automatically, an http:// Civitai or Hugging Face link in a shared workflow would have sent the token in cleartext. Both downloaders now fetch those links over https, and redirects drop the Authorization header on any hop that is not https.