Okay, it's not *that* bad
Allow auth info to be sent as a header