Hacks to ensure we don't redirect with auth credential headers

IIRC this is the correct http behavior but I would have to read some other stuff to confirm.