drop OSHTTPClient for a set of composed functions.

the 'auth' factory passed to the request function now has two
responsibilities: getting an initial token (whether cached or by
authenticating), and refreshing a token in the event that we know
that it's invalid.

This allows us to get rid of all knowledge of authentication from
the heat client.