I see what you mean now about HTTP (sorry about that :P ).

Frankly I have avoided the whole authentication issue by only exposing publicly available (in the company) data and making it query only. I couldn't use SSL in my projects (for various political reasons) and my scheme was the path of least resistance.

Until there is a standard I guess it boils down to your own environment. In my case, packing it inside the envelope will have to be the way to go. Plus our security policy (at work) is to encrypt everything, SSL or otherwise.

I do wonder, however, whether you have considered using some form of digest mechanism in your method? Do you think this is worthwhile?

Thanks for your feedback :)