Not sure if this is progress or not.
I removed the encoded token from the URL, then replaced it with with the original token (run through encodeURIComponent). I don't get a 401, but rather a 500, with this stack trace:
<error> <error_code>WSR 00999</error_code> <message>Internal error ("An internal error occured while calling 'getBlobInfos' API. (Error: ERR_WIS_30270)")</message> <stack_trace>com.sap.webi.raylight.RaylightException: Internal error ("An internal error occured while calling 'getBlobInfos' API. (Error: ERR_WIS_30270)") at com.sap.webi.raylight.context.Messenger.internalError(Messenger.java:91) at com.sap.webi.raylight.actions.ActionDispatcher.handleUnexpectedError(ActionDispatcher.java:142) at com.sap.webi.raylight.actions.ActionDispatcher.invoke(ActionDispatcher.java:122) at com.sap.webi.raylight.RaylightServiceReports.getReportImage(RaylightServiceReports.java:755) at com.sap.webi.raylight.RaylightServiceReports.getReportPageImage(RaylightServiceReports.java:773) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:173) at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:89) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:164) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:242) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:242) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:242) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:91) at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:58) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:439) at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303) at java.util.concurrent.FutureTask.run(FutureTask.java:138) at org.apache.cxf.workqueue.SynchronousExecutor.execute(SynchronousExecutor.java:37) at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:106) at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:255) at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:113) at org.apache.cxf.transport.servlet.ServletDestination.invoke(ServletDestination.java:102) at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:464) at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:149) at com.sap.bip.rs.server.servlet.BIPServletController.invoke(BIPServletController.java:93) at org.apache.cxf.transport.servlet.AbstractCXFServlet.invoke(AbstractCXFServlet.java:148) at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:179) at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doGet(AbstractHTTPServlet.java:108) at javax.servlet.http.HttpServlet.service(HttpServlet.java:620) at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:159) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at com.businessobjects.sdk.actionfilter.WorkflowFilter.doFilter(WorkflowFilter.java:45) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:763) Caused by: com.businessobjects.sdk.core.server.CommunicationException$UnexpectedServerException: An internal error occured while calling 'getBlobInfos' API. (Error: ERR_WIS_30270) at com.businessobjects.sdk.core.exception.ExceptionBuilder.make(ExceptionBuilder.java:152) at com.businessobjects.sdk.core.exception.ExceptionBuilder.make(ExceptionBuilder.java:109) at com.businessobjects.sdk.core.server.common.CommonRequestHandler.afterProcessing(CommonRequestHandler.java:127) at com.businessobjects.sdk.core.server.internal.AbstractServer.processIt(AbstractServer.java:178) at com.businessobjects.sdk.core.server.internal.AbstractServer.process(AbstractServer.java:136) at com.businessobjects.sdk.core.server.internal.InstanceServer.process(InstanceServer.java:96) at com.businessobjects.sdk.core.server.internal.blob.BlobInterpreter.getBlobInfo(BlobInterpreter.java:227) at com.businessobjects.sdk.core.server.internal.blob.BlobInterpreter.getInfo(BlobInterpreter.java:177) at com.businessobjects.sdk.core.server.internal.blob.BlobInterpreter.getMimeType(BlobInterpreter.java:106) at com.businessobjects.sdk.core.server.internal.blob.RemoteBlobFactoryImpl.create(RemoteBlobFactoryImpl.java:40) at com.businessobjects.rebean.wi.impl.services.ReportEngineOutputServiceImpl.getBlob(ReportEngineOutputServiceImpl.java:95) at com.sap.webi.raylight.business.ReportElementHelper.getBlob(ReportElementHelper.java:199) at com.sap.webi.raylight.actions.report.GetImageAction.execute(GetImageAction.java:30) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at com.sap.webi.raylight.actions.ActionInvoker.invokeWith(ActionInvoker.java:123) at com.sap.webi.raylight.actions.ActionDispatcher.invoke(ActionDispatcher.java:105) ... 50 more Caused by: com.businessobjects.sdk.core.server.ServerException: An internal error occured while calling 'getBlobInfos' API. (Error: ERR_WIS_30270) at com.businessobjects.sdk.core.server.common.CommonRequestHandler.newServerException(CommonRequestHandler.java:260) at com.businessobjects.sdk.core.server.common.CommonRequestHandler.createAllServerExceptions(CommonRequestHandler.java:238) at com.businessobjects.sdk.core.server.common.CommonRequestHandler.afterProcessing(CommonRequestHandler.java:121) ... 66 more </stack_trace></error>