The remote should automatically know if credentials should be sent based on the presence/absence of "auth_username". TBD: The node client might need something special to tell it to track cookies.