Limit 20 authorization attempts.

We use one count for both redirects and authorization attempts. This
seems like good enough policy.

Closes https://github.com/square/okhttp/issues/960