Yeah, that was my idea first, too. Then I remembered the token field. But you can force login a user with the other approach. I think in this case the token is not really useful since you have to authenticate manually on every request anyway.
The token is a prevention of CSRF attacks: https://de.wikipedia.org/wiki/Cross-Site-Request-Forgery. As I understand it correctly, it ensures that any potentially harmful request to the server is really made by you, the person using the website/app, and not someone else who might have tricked you to send a bad request. Any request is only executed if it includes the correct tokens.
@monchu
Mh, then it depends.
I would not recommend this approach, because you would have to put the credentials into the script, since you cannot (don't want to) ask for name and password every time. I guess putting plain text passwords into scripts is not so cool. ;P
But yes, it is “possible”.
Otherwise, a simpler way would be to use a “supersecret-obfuscated-url”—while keeping in mind that this is just security by obscurity and in fact the url will be public. It might be just fine if the content is not “classified”-secret but just “it just should not be so easy to find”-secret. Make sure to exclude the pages from any sitemaps, etc. ...
If you have some admin/ssh access to the server you could use scp (scp?, download file with scp) - using ssh authentication.
Or any kind of secure command thing. sftp? Maybe even curl. Not sure ... I think it depends on what you want to achieve.
Btw. I would like to put a little disclaimer here, that I am by no means a security expert - these are just pieces of my humble knowledge and please regard all of it just as hints for further own research! Anyone with profound knowledge is invited to complement and/or correct