Pass disposition instead of forcing NSURLSessionAuthChallengePerformDefaultHandling

This implementation (I believe unintentionally) forces `NSURLSessionAuthChallengePerformDefaultHandling` to be returned to the `completionHandler`.  This will ignore any `NSURLCredential` that may be provided in in the `sessionDidReceiveAuthenticationChallenge` or `taskDidReceiveAuthenticationChallenge` blocks.