If the approach of passing username and password directly in the url works, I would stick to it and eventually explain it better in the docs.