获取token之后，再调用匿名方法

js获取token

bpm.api.beginDownload = function (filePath, fileName) {
    var url = "/Home/GetToken";
    $$.getJSON(url, {}, function (data) {
        if (data.IsSuc) {
            var url = "/Home/Download?dirRelativePath=" + filePath + "&token=" + data.Token + "&fileName=" + fileName;
            window.location = url;
            //window.open(url, "_blank");
        }
    });
}

 public static Hashtable htTokens = Hashtable.Synchronized(new Hashtable());
        public ActionResult GetToken()
        {
            var token = Guid.NewGuid();
            htTokens.Add(token, Tool.GetCurrentUser());
            return Json(new { IsSuc = true, Token = token.ToString() }, JsonRequestBehavior.AllowGet);
        }
        /// <summary>
        /// 暂时无用
        /// </summary>
        /// <param name="dirRelativePath"></param>
        /// <param name="fileName"></param>
        /// <returns></returns>
        [AllowAnonymous]
        public ActionResult OldDownload(string dirRelativePath, string fileName)
        {
            string token = Request.QueryString["token"];
            if (htTokens != null && !string.IsNullOrEmpty(token) && htTokens.Contains(Guid.Parse(token)))
            {
                string uploadPath = System.Configuration.ConfigurationManager.AppSettings["BPMAttachments"];
                string dirAbsolutePath = uploadPath + dirRelativePath;

                if (!System.IO.File.Exists(dirAbsolutePath))
                {
                    return Content("提示：文件在磁盘上不存在");
                }
                htTokens.Remove(token);
                //HttpContext.Response.AddHeader("content-disposition", "attachment;filename=" + fileName);
                //return File(dirAbsolutePath, "application/octet-stream");
                var contentType = MimeMapping.GetMimeMapping(fileName);
                HttpContext.Response.AddHeader("content-disposition", "inline;filename=" + fileName);
                return File(dirAbsolutePath, contentType);
            }
            else
            {
                return Content("提示：没有权限");
            }
        }