Make sure netrc doesn't override any authentication settings explicitly set by the client
diff --git a/requests/sessions.py b/requests/sessions.py
index 6d1000dc52..c24ed5aa4c 100644
--- a/requests/sessions.py
+++ b/requests/sessions.py
@@ -289,8 +289,8 @@ def request(self, method, url,
             for (k, v) in env_proxies.items():
                 proxies.setdefault(k, v)
 
-            # Set environment's basic authentication.
-            if not auth:
+            # Set environment's basic authentication if not explicitly set.
+            if not auth and not self.auth:
                 auth = get_netrc_auth(url)
 
             # Look for configuration.
diff --git a/test_requests.py b/test_requests.py
index 7ad10ee9b0..0758210545 100755
--- a/test_requests.py
+++ b/test_requests.py
@@ -234,6 +234,34 @@ def test_BASICAUTH_TUPLE_HTTP_200_OK_GET(self):
         r = s.get(url)
         self.assertEqual(r.status_code, 200)
 
+    def test_basicauth_with_netrc(self):
+        auth = ('user', 'pass')
+        wrong_auth = ('wronguser', 'wrongpass')
+        url = httpbin('basic-auth', 'user', 'pass')
+
+        def get_netrc_auth_mock(url):
+            return auth
+        requests.sessions.get_netrc_auth = get_netrc_auth_mock
+
+        # Should use netrc and work.
+        r = requests.get(url)
+        self.assertEqual(r.status_code, 200)
+
+        # Given auth should override and fail.
+        r = requests.get(url, auth=wrong_auth)
+        self.assertEqual(r.status_code, 401)
+
+        s = requests.session()
+        
+        # Should use netrc and work.
+        r = s.get(url)
+        self.assertEqual(r.status_code, 200)
+
+        # Given auth should override and fail.
+        s.auth = wrong_auth
+        r = s.get(url)
+        self.assertEqual(r.status_code, 401)
+
     def test_DIGEST_HTTP_200_OK_GET(self):
 
         auth = HTTPDigestAuth('user', 'pass')

This fixes issue #1438.

.netrc is still going to be used by default if it's available (that's the intended behavior based on #446), but now any explicit settings (whether they're set on the session or passed to request()) will take precedence.
