Refactor the client (again) to better support auth

Allows consumers to provide their own transports for common cases.

Fixes #1499
Adds basic support for #1473
How well does this approach play with the --help logic, I assume that it all just works, but I wanted to check.