Fix RestSharedSecretAuthentication, make it use the real request (bug 943471)

https://bugzilla.mozilla.org/show_bug.cgi?id=943471

Explanation:
- `SharedSecretAuthentication` was using the proxy, so DRF's request proxy had amo_user and user set, but not the real request underneath
- `_prepare_pay()` needs a real request and not DRF's proxy.
- Since we dont usually deal with the real request in DRF views, everything was mostly fine in the rest of our code.