Hide authentication

I don't like that we changed the HttpProvider interface to expose HTTPBasic authentication.  Ideally we should lean against the Authenticator stuff that we have written.  To do that it will have to move into the HttpRestProvider layer.

In the meanwhile, I propose doing this to keep from stretching our APIs.

WDYT?