ah, this change broke multiple test cases

lib/http.c

@@ -162,8 +162,6 @@ void Curl_http_auth_act(struct connectdata *conn)
 {
   struct SessionHandle *data = conn->data;
 
-  data->state.authwant = CURLAUTH_NONE; /* clear it first */
-
   if(data->state.authavail) {
     if(data->state.authavail & CURLAUTH_GSSNEGOTIATE)
       data->state.authwant = CURLAUTH_GSSNEGOTIATE;
@@ -173,6 +171,8 @@ void Curl_http_auth_act(struct connectdata *conn)
       data->state.authwant = CURLAUTH_NTLM;
     else if(data->state.authavail & CURLAUTH_BASIC)
       data->state.authwant = CURLAUTH_BASIC;
+    else
+      data->state.authwant = CURLAUTH_NONE; /* clear it */
 
     if(data->state.authwant)
       conn->newurl = strdup(data->change.url); /* clone URL */