Make work with new API

Request objects no longer have a send mechanism. We need to either generate a
session and send with that or just use the connection connected to the response
object. This was essentially stolen from HTTPDigest authentication.

Additionally, performing another request during mutual authentication doesnt
make sense. We're authenticating the response we already received.