Yeah its because of their download intercept, the download of the PDF doesn't happen unless you have the cookie saved. So the link is to a PDF, but they check if you are authorized to download. You are getting an HTML because a normal desktop browser would present the choice buttons to save an approval cookie.