Quick thought, what are the security properties of the package? Have you tried initiating the download from the application server using the package runtime credentials?

😎