Encoding the full object is the way it was done before and i do not see a reason to change that.
The only difference is that it is now a parameter because it would conflict as the body.

if i replace that with a pseude basic auth i would create new problems
-  not all relevant parameters are transfered (server address is needed)
-  future changes to enable stronger auth would not be restricted without need
-  users could expect full basic auth behaviour which is not intended at these routes


encoding as base64 is required to be url safe