Header auth

Lay the foundations for implementing kerberos auth. Since HTTP Negotiate goes over a header, do the same for our own password auth. Use HTTP Basic instead. Note this doesn't change the UI.

Remove a bunch of code related to HTTP POST support.
Nitpick: this isn't doing a POST anymore, so we should rename this to curl_auth or similar.