Rework basic auth to only send credentials to the registry itself.

[ojacobson]

Registry implementations that redirect clients to other stores (such as S3) should not cause those stores to be presented with registry credentials.