Private downloads don't work when logged in via ORCID/auth token
When logged in using the `arctic` theme on dev.nceas.ucsb.edu (i.e. via ORCID), the EML download link to the private metadata document that I created fails to download. We get:
<?xml version="1.0" encoding="UTF-8"?><error detailCode="1400" errorCode="401" name="NotAuthorized"> <description>READ not allowed on arctic-data.11256.1</description> </error>
An example is:
The download button links directly to the /object REST endpoint:
My guess is that the `Authorization` header isn't getting set in this direct call, so with no auth token, it's seen as a public download.