Don't set auth on redirect

- Fixes a bug where nil (empty) Basic Auth is added to a request after
  redirect
- No Authorization header when user & password are present but nil