Description of issue or feature request:
Would it be possible to have a safe way for the user of the update client to customize the Session object used to download files? E.g. providing (limited?) custom parameters for the Session()?

I have two use cases in mind:

• provide Authorization credentials (e.g. basic auth or bearer token) that may be needed to access the files
• customizing the user-agent header to prepend the application's own <name>/<version>