Android WebView DownloadManager send double request (one without auth)

Question

I am new to android development

I have backend in Java/Spring + Spring Security

RestContoller:

    @GetMapping(value = "{id}")
    @ResponseBody
    public ResponseEntity downloadCard(@PathVariable(value = "id") Card card,
                                       @AuthenticationPrincipal User user) {
      try {
            ResponseEntity<byte[]> result = restTemplate.exchange(
                    "/card/" + card.getId(),
                    HttpMethod.GET,
                    new HttpEntity<>(headers),
                    byte[].class);

            return result;

        } catch (Exception ex) {
            ...
        }

    }

WebView DownloadListener

webView.setDownloadListener((url, userAgent, contentDisposition, mimeType, contentLength) -> Dexter.withActivity(MainActivity.this)
                .withPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE)
                .withListener(new PermissionListener() {
                    @Override
                    public void onPermissionGranted(PermissionGrantedResponse permissionGrantedResponse) {
                        DownloadManager.Request request = new DownloadManager.Request(Uri.parse(url));
                        request.setMimeType(mimeType);
                        String cookies = CookieManager.getInstance().getCookie(userAgent);
                        request.addRequestHeader("cookie", cookies);
                        request.addRequestHeader("User-Agent", userAgent);
                        request.setDescription("Download...");
                        request.setTitle(URLUtil.guessFileName(url, contentDisposition, mimeType));
                        request.allowScanningByMediaScanner();
                        request.setNotificationVisibility(DownloadManager.Request.VISIBILITY_VISIBLE_NOTIFY_COMPLETED);
                        request.setDestinationInExternalPublicDir(
                                Environment.DIRECTORY_DOWNLOADS, URLUtil.guessFileName(
                                        url, contentDisposition, mimeType));

                        DownloadManager downloadManager = (DownloadManager) getSystemService(DOWNLOAD_SERVICE);
                        downloadManager.enqueue(request);

                        Toast.makeText(MainActivity.this, "Download...", Toast.LENGTH_SHORT).show();
                    }

                }).check());

If i disable Spring Security - is't work.

But else - to my RestController comes double request from DownloadManager: first with auth, second - without auth.

And download does not occur, because the second request is without authorization (for example, a PDF file is downloaded, but inside the HTML code with the login form)