set Authorization header by hand

The Go AppEngine SDK doesn't allow URLs with a "username@" prefix and
requires that the Authorization header is added manually.