Google released this blog post which says:
If you authorize download requests to the Drive API using the access token in a query parameter, you will need