Currently there is no way to download a raw file without embedding
the token in the URL, which exposes the token in the URL. There
should be an way of sending this information via the header as the
API does.

Closes https://github.com/gitlabhq/gitlabhq/issues/8137