Plus, adding HTTP auth would totally fudge every tunneled app using HTTP auth for itself.