DefaultClient should not be used in API

[jefferai]

Go's http.DefaultClient turns out to be rather dangerous, because it is a global variable and very easy for multiple parts of a program to modify its TLS and other configuration and stomp all over everything else using it. Using it was the cause of race conditions in Vault and consul-template.

I believe that clashes between Consul using http.DefaultClient in its API and the GitHub/OAuth2 libraries using http.DefaultClient in their APIs are the source of hashicorp/vault#700

http.DefaultClient is simply &http.Client{}. The Consul API should switch to using its own client, not only to ensure other pieces of a program don't step on its own configuration, but also because if CONSUL_HTTP_SSL_VERIFY is set, the Consul API itself will define its own http.Transport and step on anything else that has been set.