Sending a clear text username token over unsecured HTTP transport