Hacker News Reader

Why would you need the client to send the request over and over when you control the backend?

Not to send the password in plain, maybe?

Are you aware of transport encryption?