To land after #230

@yangchoo Just so I'm on the same page. We were always requesting using http and being redirected, then rebuilding the request without the required headers. Or was it using the same headers and reusing the signature initially generated?

@EribertoLopez

Or was it using the same headers and reusing the signature initially generated?

It's more of this case. In the case of redirects, we were still using the initial authz header, which is no longer valid for the updated address.

Note that we have also written custom logic for resolving whether it is an internal_request. This was bypassed in the case of the original rebuild_auth function. That had its own logic for stripping auth headers and handling a similar situation.

We are basically taking full responsibility over the auth header building process.