use a header for Authorization after all.  it is encrypted