From curl.h
/* Continue to send authentication (user+password) when following locations,
even when hostname changed. This can potentially send off the name
and password to whatever host the server decides. */
CINIT(UNRESTRICTED_AUTH, LONG, 105)
I set this option and it fixed my problem. Sometimes you just need to dig a little more. :)
curl_easy_setopt (curl, CURLOPT_UNRESTRICTED_AUTH, 1);