I have captured some information from an app http session and am trying to decipher how the app is passing authentication. I have tried multiple methods/combos but can't seem to figure out how they are passing credentials.

The capture:
------------

```
GET /features HTTP/1.1
user: thisUser@email.com
X-Password: ThisUserPassword
Accept: application/json
Cache-Control: public, max-age=1 max-stale=1
X-NewRelic-ID: VQ4AV1BbGwIIXVFXAwM=
Host: www.blah.com
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/2.3.0
If-None-Match: "d751713988987e9331980363e24189ce"

HTTP/1.1 304 Not Modified
Status: 304 Not Modified
ETag: "d751713988987e9331980363e24189ce"
Cache-Control: max-age=0, private, must-revalidate
X-UA-Compatible: IE=Edge,chrome=1
X-Runtime: 0.034169
X-NewRelic-App-Data: PxQGWVFVDgsTVVdWBAYBVkYdFHANCBcQXw5UB0oXR1dBE1ACVBIcFgVOXj4LAl9aUzsUEVJDGAABUEJGEAMQQBxSFlIUCBoCAFAMUwRRC1FRAgZZUVMJARxJUE4VBgBVV1QGUFEHAAdSVAFXCBpp
Accept-Ranges: bytes
Date: Wed, 18 Jan 2017 13:55:45 GMT
X-Varnish: 405330697
Age: 0
Via: 1.1 varnish
Connection: close
X-Varnish-Cache: MISS
X-Frame-Options: SAMEORIGIN

```

I have tried these combos:

```
var headers = {Authorization:"Basic thisUser@email.com:ThisUserPassowrd"} ;
var headers = {Authorization:"thisUser@email.com:ThisUserPassowrd"} ;
var headers = {Authorization:"Basic user:thisUser@email.com,X-Password:ThisUserPassowrd"} ;
var headers = {Authorization:"user:thisUser@email.com,X-Password:ThisUserPassowrd"} ;

```

I even tried encoding:

```
  var userCreds = btoa("thisUser@email.com:ThisUserPassowrd") ;
  //
  var headers = {"Authorization": "Basic" + userCreds} ;
  var headers = {"Authorization": userCreds} ;

```

Here is my http call, I am swapping in/out "Basic " & userCreds/userCreds1 for various tests:

```
  var userCreds = "thisUser@email.com:ThisUserPassword" ;
  var userCreds1 = btoa(userCreds) ;
  var baseUrl = "https://www.blah.com" ;
  var headers = {"Content-Type":"application/JSON", Authorization: userCreds1} ;
    var req = {  
      method: 'GET',
      url: baseUrl + '/features' ,
      headers: headers
    }
    return $http(req).then(function(response) {

```

The error I am getting is "UnauthorizedAccess: either email or password is incorrect". I mean, is it looking for the actual fields "user" and "X-Password" to be passed in too?

Can someone help me figure what the correct method is here?