This makes it work against the API in 1.1.0

Some of the details about how the response hook is called appears to have changed;

Technique for fixing authenticate_user cribbed from requests.auth.HTTPDigestAuth; change to authenticate_server comes from staring at the code and concluding that there was no there there.