When redirecting to acquire file access tokens, retain 'download' parameter

Summary: Fixes T7398. Previously, we would redirect to get a token and then redirect back to make use of it, but lose "download" in the process, and thus not get the correct "Content-Disposition" header.

Test Plan: Clicked "Download" on a lightboxed file.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T7398

Differential Revision: https://secure.phabricator.com/D11915