That's why I pay him.

Steve answers (in the middle of this all-over-the-map post and later in this one) why not use HTTP authentication for an XML-RPC API, as asked the other day.