Mainly so that we can support HTTP basic and OAuth tokens obtained elsewhere, but also other headers.