The auth state machine must be reinitialized at every connection.

NOTE: There are still (probably, untested) leaks if HTTP response
contains multiple auth-related header lines with the same name.