Add tests to show we drop authentication headers on redirect.

At the moment, we don't and the tests fail!
https://github.com/square/okhttp/issues/810