Add timeouts.

This also allows the upload to do multiple passes even if it's timing out.
Migrate auth requests to use the same calling logic.