It is weird that you connect to the API through http and send user and password in plain text.