Except you usually send the password once, and get back a cookie with a token that you present for the rest of your session (possibly to other endpoints/servers). Whereas with basic auth, the login/password keeps being sent.