Strip Authorization header whenever root URL changes

Previously the header was stripped only if the hostname changed, but in
an https -> http redirect that can leak the credentials on the wire
(#4716). Based on with RFC 7235 section 2.2, the header is now stripped
if the "canonical root URL" (scheme+authority) has changed.

Closes #4716.

# [Codecov](https://codecov.io/gh/requests/requests/pull/4718?src=pr&el=h1) Report
> Merging [#4718](https://codecov.io/gh/requests/requests/pull/4718?src=pr&el=desc) into [master](https://codecov.io/gh/requests/requests/commit/33b41c7880a02166d12915ca9c4cfc13de2d9fb7?src=pr&el=desc) will **decrease** coverage by `0.02%`.
> The diff coverage is `90%`.

[![Impacted file tree graph](https://codecov.io/gh/requests/requests/pull/4718/graphs/tree.svg?width=650&token=mZGswIiXLa&height=150&src=pr)](https://codecov.io/gh/requests/requests/pull/4718?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master    #4718      +/-   ##
==========================================
- Coverage   66.79%   66.77%   -0.03%     
==========================================
  Files          15       15              
  Lines        1563     1568       +5     
==========================================
+ Hits         1044     1047       +3     
- Misses        519      521       +2
```


| [Impacted Files](https://codecov.io/gh/requests/requests/pull/4718?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [requests/sessions.py](https://codecov.io/gh/requests/requests/pull/4718/diff?src=pr&el=tree#diff-cmVxdWVzdHMvc2Vzc2lvbnMucHk=) | `76.34% <90%> (+0.06%)` | :arrow_up: |
| [requests/models.py](https://codecov.io/gh/requests/requests/pull/4718/diff?src=pr&el=tree#diff-cmVxdWVzdHMvbW9kZWxzLnB5) | `77.35% <0%> (-0.23%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/requests/requests/pull/4718?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/requests/requests/pull/4718?src=pr&el=footer). Last update [33b41c7...2f24e02](https://codecov.io/gh/requests/requests/pull/4718?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


> While I’m inclined to merge this, there’s likely some concern about breaking users relying on us not doing the right thing here.

Totally understood. There is always [someone](https://xkcd.com/1172/).

I'll just leave this here: urllib3/urllib3#1346

@SethMichaelLarson we currently perform the redirects manually because we’ve got a few more steps we perform. I’ve looked at moving to urllib3 with 1.23 but don’t know if I see an easy route that guarantees we maintain our 2.X expectations.

@nateprewitt TIL! Thanks for teaching me that. :)

@nateprewitt I've made the changes you suggested.

@SethMichaelLarson so what behaviour does urllib3 have on https->http redirects to the same host?

@nateprewitt this shouldn't break too many people. The major breaking change already happened years ago. I'm 100% 👍 on this. I haven't reviewed the code though.

@nateprewitt is there anything still outstanding here?

Actually sorry @bmerry, it looks like this isn’t rebased onto master. Would you mind rebasing really quickly and then we can get this merged.

Ok, I've rebased.

And I've rebased again.

Are there plans to release this security fix soon?

@ofek, it’d be preferable to coordinate with urllib3 to avoid having to do multiple releases. I don’t think we have a timeline to commit to, but we may be able to do something in the next 3-8 weeks. If it’s going to go beyond that, we can look at cutting a Requests release without urllib3.

@nateprewitt feel free to ping one of us if ya'll want to make a release with us, we've been due for a release as well. Reminder: the next release of urllib3 will have dropped Python 2.6 support.

@SethMichaelLarson Yep, we’ll make sure that’s surfaced in the release notes. I’ll ping you and/or Thea this weekend and we can work out a timeline.

This has been assigned CVE-2018-18074