If you can get JS executing on the client desktop, with their cookies, with cors whitelisted, you can make a request just like their JS would.

i.e. make the same POST to their api, using the cookie/auth as the original user would, to transfer the files. Its just an ajax call.

Outstanding research! I particularly enjoyed how the presenter in the video shut up the arrogant person from the audience.