fixes #1828 make connection.authorize not mutate headers

Make connection.authorize not mutate headers; instead moving urlencoding down to util.canonical_string for auth to still work correctly