Request with method-level auth differs from request with equivalent session-level auth

## Summary

Explicitly calling out method-level auth parameter that matches associated session-level auth seems to yield functionally different behavior.

## Expected Results

I am parsing a CSV file containing references to local filenames that I am uploading via Requests to a RESTful API I'm helping test. The intended behavior is for the script to upload the files referenced in the CSV after establishing Digest authentication. The server should respond 401, then requests should respond accordingly, followed by a 200 response from the server.

## Actual Results

I recently encountered an error response from the server and found I got a different response simply by updating my python code to use Session() objects. Upon further testing, I have developed two code blocks that appear to be functionally equivalent but receive very different responses from the server. I am having a hard time determining why these two code blocks behave differently.

The first code block shown below properly negotiates Digest authentication, receiving a 401 response from the server, sending the second part of the request, then receiving a 200 response.

The second code block is as close to the first as I can make it while still reproducing the problem. Notice the code snippet contains a method-level auth argument which is an exact duplicate of the session-level authentication. However, for whatever reason, the API I'm testing responds 502 to this latter code block in response to the initial request, i.e. the point at which I would expect a 401 response. I will address the server-side error, but I'm confused regarding how the two blocks of code are functionally different.

```
import sys, time, requests, csv
from requests.auth import HTTPDigestAuth, HTTPBasicAuth
custom_header = {'X-Requested-Auth': 'Digest'}
host = raw_input("Enter host address, including scheme: ")
user = raw_input("Enter username: ")
password = raw_input("Enter password: ")
#v1 is a string representation of some xml
with open('myFiles.csv', 'rb') as csvfile:
    csvin = csv.DictReader(csvfile, delimiter=',', quotechar='"')
    with requests.Session() as s:
        #Define session-level auth method and custom header
        s.auth = HTTPDigestAuth(user, password)
        s.headers.update(custom_header)
        for row in csvin:
                data = {'param1': v1, 'param2': 'some value'}
                with open(row['Presentation File'], 'rb') as f:
                    print "Track found. Uploading..."
                    r = s.post(host+'/api/uploadTrack', data=data, files={'file': (row['Presentation File'],f)}, verify=False, timeout=(6.05, 70))
```

```
import sys, time, requests, csv
from requests.auth import HTTPDigestAuth, HTTPBasicAuth
custom_header = {'X-Requested-Auth': 'Digest'}
host = raw_input("Enter host address, including scheme: ")
user = raw_input("Enter username: ")
password = raw_input("Enter password: ")
#v1 is a string representation of some xml
with open('myFiles.csv', 'rb') as csvfile:
    csvin = csv.DictReader(csvfile, delimiter=',', quotechar='"')
    with requests.Session() as s:
        #Define session-level auth method and custom header
        s.auth = HTTPDigestAuth(user, password)
        s.headers.update(custom_header)
        for row in csvin:
                data = {'param1': v1, 'param2': 'some value'}
                with open(row['Presentation File'], 'rb') as f:
                    print "Track found. Uploading..."
                    r = s.post(host+'/api/uploadTrack', auth=HTTPDigestAuth(user, password), data=data, files={'file': (row['Presentation File'],f)}, verify=False, timeout=(6.05, 70))
```


## System Information

```
{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "2.6"
  },
  "implementation": {
    "name": "CPython",
    "version": "2.7.5"
  },
  "platform": {
    "release": "3.10.0-693.2.2.el7.x86_64",
    "system": "Linux"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.18.4"
  },
  "system_ssl": {
    "version": "1000105f"
  },
  "urllib3": {
    "version": "1.22"
  },
  "using_pyopenssl": false
}
```

Note that I can reproduce in a Windows environment using request 2.11.1, so this is not a recent regression.

Do you have a `~/.netrc` file? What happens if you set `trust_env=False` in the request?

I don't have a ~/.netrc file.
When I inject trust_env=False in the individual s.post kwargs, I get a TypeError for unexpected argument trust_env.

If I set the session attribute `s.trust_env = False`, then I still get a 200 when omitting the auth argument from the s.post and 502 when including it directly within s.post args.

What happens if you unset your custom auth header?

With respect to the test API behavior, without the custom header set, the test API generally responds with a 302 redirect. However, once the session has successfully negotiated digest authentication once, it appears the client does not need to continue providing the custom header assuming the client continues to provide the digest headers and calculates the appropriate response string. In other words, the custom header is only needed to get the initial 401 response.

When I test with curl without preemptively generating the digest headers with each subsequent call, I get the 302 response as expected when omitting the custom header.

However, using python and Requests, for this particular request, if I omit the custom header (so it is defined neither defined session-wide nor as an argument for the post method) and explicitly call out the auth in the post method, I receive a 502 instead of the expected 302.

I decided to remove an intermediate proxy from my test setup, so where I previously saw 502, I now get requests.exceptions.ConnectionError: ('Connection aborted.', error(104, 'Connection reset by peer'))

I'm adding additional debug prints to see if anything else stands out.

Without the proxy in place, it appears that I can get a 200 response if I accompany the duplicate auth argument with the custom header at the method level.
v_v I am starting to wonder if there the issue is tied to the timing of packets sent. Functionally I don't see what would be different in the generated requests.

This seems to be an issue with the server at use. Without further evidence and with such a long period of silence, I'm closing this issue.