Passing passwords to HTTP checks