Auth to use headers instead of get params.

Avoids passwords being logged by most servers.
Store client IP in index.