Requests 2.3 strips Authorization headers when redirects send requests
to URLs with different DNS names, which results in requests with no
Authorization headers at all. We address this by switching off its
internal redirect handling.
Note that the means by which this is done does not exist in requests
1.1.