I think by following @jrudolph's proposal we can actually get rid of the `scheme`, `realm` and `params` methods in `HttpAuthenticator`, no? And I agree that access to the `HttpRequest` is sufficient.