At the moment we are able to view images held in Windchill via SAP Business Objects when a user logs onto the client however when it comes to downloading images to PDF, it goes through the Busness Objects Server which the users do not have access to so we need to find a way to be able to silently pass the Flex users credentials else the user does not have the ability to download the images.
Re: passing username and password (Credentials) through url
None of the webservers accepts password from the URL query parameter without using add on modules. Webserver does not convert query parameters to authorization header. More over this would be a red flag for IT security.
Did you consider building a webservice or a filedownload servlet? If you are in Windchill 11, you have a file download REST API for this