fix: track preflight authentication through the redirect policy

Reading Response.Request to learn whether the answer was authenticated fails with a caller-supplied transport that leaves it unset: the last fix then reported every answer as unauthenticated, and a refused token lost its anonymous retry. Record each redirected request's Authorization after the client's redirect policy has run instead, which needs nothing from the response.