Refactor the client (again) to better support auth

Allows consumers to provide their own transports for common cases.

Fixes #1499
Adds basic support for #1473