ClientRequest auth should use an Authorization header

[djones6]

In #171 we noted that currently, the username and password fields are being sent as part of the URL for basic authentication, and that they are currently not percent-escaped by the NIO client.

Rather than escaping them, I believe they should instead be sent in an Authorization header. This would alleviate the need to escape their values, besides being recommended practice. Normally the Authorization header is sent in response to a server sending a WWW-Authenticate header, but I believe it's valid to provide it outside of that flow.

This would be a behavioural (breaking?) change as the format of the URL would change where basic authentication is being used, and would require recipients to support parsing the Authorization header (which I believe they should do, but I can imagine there may be implementations out there that assumes they'll be tacked on to the URL).

Both Kitura-NIO and Kitura-net would need to be changed to behave consistently.

[djones6]

We discovered that for Kitura-net, libcurl already handles this for us: credentials prepended to the URL are removed and sent instead as an Authorization header.

Need to confirm whether the same happens for Kitura-NIO.

[djones6]

This was merged (for Kitura-NIO).