Really don't like attaching password to query string. That will show up in browser history.

Better would be to use HTTP Authentication header.