various (proxy) authentication fixes

Hi,

- don't abort connections with pending Negotiate authentication

  this basically clones the behaviour from NTLM for Negotiate; the checks should be more precise now (not mixing proxy/normal auhentication), and `conn->bits.close` is checked before we decide not to close it.
- free proxyuserpwd too after sending a request header

  When I first sent this patch to the mailing list I said something about "ugly hack"; now I'm convinced this is the right way to go and a clean solution (it is the same as is done for the "normal" header, and it is done in `http_proxy.c` too).

  This does not prevent anyone from adding special header cleanup stuff to Negotiate.

- don't abort CONNECT requests (they never have a body)

  I asked on the ML for a better check, but didn't quite understand the response:

  > Isn't conn->tunnel_state[sockindex] better for that? Or
  > data->state.authproxy.done ?

  Feel free to modify the patch to check other parts of the state.