Auth revisit

We've hit authentication scenarios that need more control over the request options. Therefore, I've changed what an 'auth' object should look like. The problem is that this represents an API change and will break existing alternative authentication mechanism. I'm not aware of any externally, but it's possible that they exist. Therefore, this would signify a major API breakage and a major API bump unless code is added to make both work (with a deprecation warning).

Note: this also includes commits from #385 to avoid future conflicts.