[fix] register the HttpAuthenticationFeature on the Client isntead of the WebTarget

this prevents Jersey from leaking cloned instaces of org.glassfish.jersey.client.ClientConfig.State
on each request - see: https://java.net/jira/browse/JERSEY-2378