Skip user auth. You're missing the broader problem. User auth is a narrower problem-answer pair. The broader problem you touched upon yourself. You have to use custom code for everything else. You could use the custom code to handle user auth, but yes, you CAN use HTTP's facilities.

SOAP gets rid of that custom code for everything else. No XML parsers, no comma delimit parsers, no mime64, uuencoding or urlencoding data. The spec covers that for you and kits as well in some form.