Auth field injection now correctly happens for HMAC authorization headers.

Previously, request.authorization was required, however this does not get set correctly when HMAC style Authorization is used. We now just depend on the Authorization header being present in the request.