c2d093bc90
This AList deployment (sales.dobotoa.cn family) only recognizes x-api-token on the /p/ download route; an Authorization header gets 302'd to login.dingtalk.com. Probe x-api-token first, fall back to Authorization, then fail-closed.