diff --git a/HISTORY.rst b/HISTORY.rst
index eed85e8..8612723 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -4,7 +4,7 @@ History
 UNRELEASED
 ++++++++++
 
-nothing yet
+- Avoid automatic netrc authentication for OAuth2Session.
 
 v1.1.0 (9 January 2019)
 +++++++++++++++++++++++
diff --git a/requests_oauthlib/oauth2_session.py b/requests_oauthlib/oauth2_session.py
index 7ad7b46..6fa4453 100644
--- a/requests_oauthlib/oauth2_session.py
+++ b/requests_oauthlib/oauth2_session.py
@@ -74,6 +74,10 @@ class OAuth2Session(requests.Session):
         self.auto_refresh_kwargs = auto_refresh_kwargs or {}
         self.token_updater = token_updater
 
+        # Ensure that requests doesn't do any automatic auth. See #278.
+        # The default behavior can be re-enabled by setting auth to None.
+        self.auth = lambda r: r
+
         # Allow customizations for non compliant providers through various
         # hooks to adjust requests and responses.
         self.compliance_hook = {

diff --git a/tests/test_oauth2_session.py b/tests/test_oauth2_session.py
index 9b19f1f..fda0c73 100644
--- a/tests/test_oauth2_session.py
+++ b/tests/test_oauth2_session.py
@@ -1,6 +1,9 @@
 from __future__ import unicode_literals
 import json
 import time
+import tempfile
+import shutil
+import os
 from base64 import b64encode
 from copy import deepcopy
 from unittest import TestCase
@@ -242,3 +245,36 @@ class OAuth2SessionTest(TestCase):
             self.assertIs(sess.authorized, False)
             sess.fetch_token(url)
             self.assertIs(sess.authorized, True)
+
+
+class OAuth2SessionNetrcTest(OAuth2SessionTest):
+    """Ensure that there is no magic auth handling.
+
+    By default, requests sessions have magic handling of netrc files,
+    which is undesirable for this library because it will take
+    precedence over manually set authentication headers.
+    """
+
+    def setUp(self):
+        # Set up a temporary home directory
+        self.homedir = tempfile.mkdtemp()
+        self.prehome = os.environ.get('HOME', None)
+        os.environ['HOME'] = self.homedir
+
+        # Write a .netrc file that will cause problems
+        netrc_loc = os.path.expanduser('~/.netrc')
+        with open(netrc_loc, 'w') as f:
+            f.write(
+                'machine i.b\n'
+                '  password abc123\n'
+                '  login spam@eggs.co\n'
+            )
+
+        super(OAuth2SessionNetrcTest, self).setUp()
+
+    def tearDown(self):
+        super(OAuth2SessionNetrcTest, self).tearDown()
+
+        if self.prehome is not None:
+            os.environ['HOME'] = self.prehome
+        shutil.rmtree(self.homedir)

OAuth2Session doesn't use token if netrc is present
The Heroku Toolbelt client uses a `.netrc` file to store its credentials locally. When using OAuth2Session, giving a properly-formed `token` to the constructor, the `auth` property on the session is not set, and requests goes and looks for a netrc file to add them in automatically when the request is made. When we _have_ set the token, this really needs to not happen.

The "ideal" fix would be to have the `OAuth2Session.auth` property set to `OAuth2`. I definitely don't know the complexities of how difficult this is, but this bug makes OAuth2Session unusable for me, and I'm having to drop down to using `OAuth2` auth directly instead for my use-case.
tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_add_token tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_refresh_token_request
tests/test_oauth2_session.py::OAuth2SessionTest::test_access_token_proxy tests/test_oauth2_session.py::OAuth2SessionTest::test_add_token tests/test_oauth2_session.py::OAuth2SessionTest::test_authorization_url tests/test_oauth2_session.py::OAuth2SessionTest::test_authorized_false tests/test_oauth2_session.py::OAuth2SessionTest::test_authorized_true tests/test_oauth2_session.py::OAuth2SessionTest::test_cleans_previous_token_before_fetching_new_one tests/test_oauth2_session.py::OAuth2SessionTest::test_client_id_proxy tests/test_oauth2_session.py::OAuth2SessionTest::test_fetch_token tests/test_oauth2_session.py::OAuth2SessionTest::test_refresh_token_request tests/test_oauth2_session.py::OAuth2SessionTest::test_token_from_fragment tests/test_oauth2_session.py::OAuth2SessionTest::test_token_proxy tests/test_oauth2_session.py::OAuth2SessionTest::test_web_app_fetch_token tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_access_token_proxy tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_authorization_url tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_authorized_false tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_authorized_true tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_cleans_previous_token_before_fetching_new_one tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_client_id_proxy tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_fetch_token tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_token_from_fragment tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_token_proxy tests/test_oauth2_session.py::OAuth2SessionNetrcTest::test_web_app_fetch_token