That's a good suggestion - will see if we can add a para about it. We use digest authentication, fwiw.