In theory you could encrypt the payloads via some other means and use something like HTTP digest authentication, but I'm sure that's not what happens here.