I guess it's meant to go over TLS, just like HTTP basic auth.