MOB-9 PoC — download token leak
A) open .pdf (download leak)
tapping opens the in-app PDF viewer -> downloads URL with app auth headers