Updated based upon latest feedback from Gary:
 - Switched to pass in only the user header.
 - Added instructions for using the RemoteHostTrustLoginModule to trust a system that does not provide a password header (eg, SiteMiner). This seems to be the common usecase for this type of module.