i think they are just an HTTP thing, could be wrong though, but I believe the authorization happens in the HTTP layer