allow 'auth' to be sent through the _request function

cc @agroener 
re: https://github.com/astropy/astroquery/pull/417

Pass `auth` through to requests, but *don't* use it for hashing (since it can and should include a password)