Use HMAC auth rather than HTTP Basic