The “Download file” action works correctly. It downloads what the web server returns.
The reason you get an HTML page instead of an XSLS file is because the web page requires a web-form submitted in order to log in. The “Download file” action is not intended to work with this type of authentication. It should be emulated using the “Web request” action. See this topic: Login to website and download
