Tor Browser does not isolate the pdf 'download' (via the download button) to URL bar domain
I've logged in to the pets reviewing website, and I clicked on a pdf, and the pdf.js is showing me the pdf. Then I click on the 'download' link inside the pdf viewer, which in the past caused a pdf to end up on my disk. Now it causes an html file, essentially saying that I wasn't logged in, to end up on my disk instead.
I managed to work around it by "right click, save page as", which does what the download button used to do. But not sending any of the current credentials/cookies/etc to whatever is doing the download is pretty surprising.