I think this isn't necessary anymore; it was for header auth which apparently isn't supported for this kind of API consumption, i.e. only supported with a client password.