Any reason for not using the standard [Authorization](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.8) HTTP header here?