Instead of using action “Open URL in Window”, we've added action Run Activity. This activity sets the required parameters and then does a Show-HTML. Inside the HTML we do a XHR request (with the custom header information) to the external system (DMS) and then try to view the document. We were able to do a "preflighted" request (see picture below), but only by running the activity in stand-alone mode. When we tried to run the activity inside the application, by clicking the Link in the repeat grid, we don’t see any results or relevant HTTP headers traffic.

You can see the HTML (and JS) code below:

<div id="dms-document-viewer"></div>
<script>
var token = "<%= tools.getParamValue("authToken") %>";
var documentURL = "<%= tools.getParamValue("DocumentURL") %>";
var docID = "<%= tools.getParamValue("docID") %>";
var dmsURL = documentURL + "?docID=" + docID;

var dmsDocumentViewer = document.getElementById("dms-document-viewer");
//alert("DMS URL: "+dmsURL);
var request = new XMLHttpRequest();
request.open('GET', dmsURL, true);
request.setRequestHeader("token", token);

request.onload = function() {
  if (request.status >= 200 && request.status < 400) {
    // Success!
    var resp = request.responseText;
    dmsDocumentViewer.innerHTML = resp;
  } else {
    dmsDocumentViewer.innerHTML = "We reached our target server, but it returned an error";
  }
};

request.onerror = function() {
  dmsDocumentViewer.innerHTML = "There was a connection error of some sort";
};

request.send();
</script>

Thanks