Fix issue #160, remove auth header on redirect

This fix removes the authorization header when the host
that's being redirected to is different than the host
that's redirecting, if the hosts are the same then the
auth header remains the same.

Tests included.

This is try 2, I don't think the first pull request sent successfully.