being more defensive about how we put together the URI value before hash...

...ing

Due to ambiguity in the HTTP RFC (http://www.w3.org/Protocols/rfc2616/rfc2616.txt) individual package developers are at liberty to determine whether req.RequestURI contains just the path?plus=args or the http://full.request/with/path?plus=args and some golang http wrappers make one choice while others make the other choice.
No need for the `fmt.Sprintf`:

```go
auth.RequestURI += "?" + req.URL.RawQuery
```