another step in the right direction.

request_with_reauth is now called request_with_auth, and no longer
retries requests when reauthentication is required. It still does
reauthentication, but then just returns the original response, so
commonly an APIError will still be raised.

Then, the "retry" function can handle the exceptions and retry the
whole thing.

Updated tests for the reauthentication, but haven't yet written
tests for retrying.