My organization is having the same problem. Browsers such as Edge and IE have character limits on their URLs (and accordingly their GET requests), so we moved our security token to the header and use POST requests to retrieve resources (including PDFS).
The problem is that the Chrome PDF viewer insists on using a GET request when you click the download button.
Were you able to find a solution to this problem?