simplify auth_request even further, so it accepts a Request instance
instead of a function-of-Effect-of-Request. This also allows it to
drop the "headers" argument.