in reply to Altering data in STDIN

Apache's Basic Authorization's data is not passed to CGI application.

Isn't it accessible via $r->user()?