Limit 20 authorization attempts.

We use one count for both redirects and authorization attempts. This
seems like good enough policy.

Closes https://github.com/square/okhttp/issues/960
any reason not to rename this to MAX_FOLLOW_UPS? (guessing this is a symbol not found dodge)