Send Authorization header only for same-origin requests

Requests to different origins could have leaked the users credentials. But for now the client did only perform same-origin requests, so this behavior did not cause any security issues.

Furthermore, the previous behavior could lead to failing requests if the target did handle the header.