I was reading over this PR again and I think I like your change as it is. It might make most sense to follow the convention of the go code where the client always sends authentication when it has been configured, but that would be a change in the existing behavior, whereas this PR introduces a new flag, so we can safely release this as a minor version release.

What do you think? Should we merge this as-it-is (maybe I'll add a few lines of documentation around it), or should we follow the convention in the go client and always send any auth parameters that have been configured by the client?