You could login (or have VBA login) separately, then try to retrieve the file.
Clearly the "GET" submittal isn't satisfying the login request.
Alternatively, you might grant "Anonymous" access to the server, DB, and file. It'd defeat securing the file from any prying eyes, though.