Currently, all requests go through lfsapi.DoWithAuth() to make requests. This code is associated with a remote, and sets/checks an Access Mode based on the LFS API URL for the associated remote. If the access mode is None, an unauthenticated request is made, and otherwise credentials are added to the request. If a None request fails, the access mode is set to Basic, and a new request is made.

However, there are two types of requests made with Git LFS: API requests, and transfer adapter requests. While all requests against the API will use the remote URL, the transfer adapter can route requests to a totally different URL. However, since the same auth/request code is being used, these requests will use the access mode for the remote URL, even though the request can be against something totally different. If we've already discovered the remote URL requires credentials, this will cause credentials to be sent across to the separate transfer adapter URL, even if it doesn't require authentication.

We should instead refactor the auth code to remove the access mode management. Instead, the lfsapi package and the tq (transfer adapter) package should handle access mode themselves for their respective URLs, and only use shared code to get credentials and actually make the requests. This should ensure we're sending credentials at the right times for the right URLs.