Authorization headers not passed in authlib

[alexgolec]

I recently encountered an issue with OAuth authorization headers being passed by authlib's version of the OAuth2Client. By gut tells me this is likely an authlib issue, but I'm posting this report here on the off chance that maintainers spot anything suspicious:

lepture/authlib#358