Looking at RFC 2617 now, we could use it with a custom credentials scheme, to stay within the spirit of the header. We'd have to break up the credentials, but that's no bid deal. We'll be controlling both ends of the client server request here, so we can revisit this when working on the client scripts.