Login to website and download

Yes. that's correct. Extract the token and then do a 1-cycle iteration to pass the token into another module which would use it in a web request as a parameter.