Credentials hiding in plain sight or how I pwned your HTTP auth | Hacker News Reader