Prevent unnecessary auth challenge query

The basic NSUrlConnection auth handling issues 2 requests: one without the auth to confirm that an auth header is required, and then one with auth. This is an unnecessary roundtrip, since we know auth will be necessary.

Additionally, when a 401 error was returned from the authed request, it looks like a 3rd query is also issued without auth. I think this is to get the response value without auth to send back to the client.

Let's just specify the auth header manually. This also lets us switch from Basic to Bearer.

r? @raycmorgan
CC @jflinter