I think any thorough investigation will conclude that there is, in fact, no way to securely authenticate a web user over unencrypted http.