Make sure netrc doesn't override any authentication settings explicitly set by the client

This fixes issue #1438.

.netrc is still going to be used by default if it's available (that's the intended behavior based on #446), but now any explicit settings (whether they're set on the session or passed to request()) will take precedence.