Problem

This snippet is misleading in some cases:

The Authorization header is cleared on auto-redirects and HttpWebRequest automatically tries to re-authenticate to the redirected location. In practice, this means that an application can't put custom authentication information into the Authorization header if it is possible to encounter redirection. Instead, the application must implement and register a custom authentication module. The System.Net.AuthenticationManager and related class are used to implement a custom authentication module. The AuthenticationManager.Register method registers a custom authentication module.

It's quite true that the Authorization header is cleared for an auto-redirect, but the rest of the paragraph strongly ("Instead, ...") makes it sound like you can naïvely rip out code that previously set the Authorization header and replace it by implementing and registering a new IAuthenticationModule-implementing object. I read this and happily set off to implement that solution, only to conclude a few hours later that it was a dead end in my case.

The problem is that this suggestion only works if you're dealing with a server where authentication is mandatory, which is not the case in all situations where the Authorization header might be sent. The GitHub API allows authorization but does not require it; the benefit if provided is a much higher rate limit. The GitHub API also uses redirects when a file is requested from a repo that has been moved or renamed (when the old location is requested).

If you attempt this solution for the GitHub API, your IAuthenticationModule code will never be called, because the server never demands authentication. Not only will your auto-redirects not be authorized (and therefore be subject to the GitHub API's anonymous rate limiting), as before attempting this solution, but so will your initial requests. It's lose-lose.

Summary

I tried to keep the existing text intact as much as possible while adding caveats and clarification so the reader can tell more easily whether the old suggestion applies to his or her use case.

Then I added a new short paragraph explaining the impact for the optional authorization use case; as far as I can tell, there is no way to use AllowAutoRedirect successfully in this case, so it must be set to false and the redirects handled manually. If an official tech expert can correctly tell me differently, I will be delighted beyond words.

FYI to my team member @DasSkelett in case you feel like doing some proof-reading and confirming this is what you've seen in testing.