Obviously :-) If you're going after basic-auth-headers, you'd probably be sniffing the network. > Authenticate once, generate a token, and use the token for au

Obviously :-) If you're going after basic-auth-headers, you'd probably be sniffing the network. > Authenticate once, generate a token, and use the token for auth from that point. If that token is passed back and forth in the http url, it ends up at places where it's easy to find/intercept. You can use a gazillion bcrypt rounds to store the password: they still send me a link to a page, including their auth-token.