Note to self: in order to allow for HTTP Basic vs. request body params, turn this into a factory and inject it