Change unscoped token fallback to be session aware

The existing way of sending requests to the auth_url was to override the
management_url for the duration of a single call. Aside from being ugly,
this won't work with session objects where the management_url is
ignored.

The tests for this behaviour have been previously merged to ensure that
the before and after behaviour remains unchanged.

Change-Id: I879adcb25dd373ab4a7b77b6539974e22220aad4