Headers indeed, although not how you think — through the HTTP auth.