Explain why only basic HTTP auth