Auth is part of request, not URL

fixes problems on GAE, whose http.Client implementation doesn't
automatically extract the user portion of a URL as basic auth.