Support download access by PRIVATE-TOKEN header

Originally opened at !2522.

Currently there is no way to download a raw file without embedding
the token in the URL, which exposes the token in the URL. There
should be an way of sending this information via the header as the
API does.

Closes https://github.com/gitlabhq/gitlabhq/issues/8137

See merge request !2683