Why are you base64 encoding entire JSON object?  Why would you not pass authentication data via the Authentication header?