use NewRequest / RoundTrip to not get redirect