With server tokens attached automatically, an http:// Civitai or Hugging
Face link in a shared workflow would have sent the token in cleartext.
Both downloaders now fetch those links over https, and redirects drop
the Authorization header on any hop that is not https.