This is unfortunate, but it is required for at least one provider, Photobucket. The expectation in the case of Photobucket is that signing will occur against the original domain instead of the subdomain they redirect to. This adds a header which is set to the first URL rauth sees on a request.

Additionally we store params and data because Requests seems to drop these as it resolves redirects and of course they're required for signing. I'm not really too happy with this solution, so I'm open to other ideas here. :)