title: Web API BasicHttpAuth with hashed password
body: <p>So I have a web Api that authenticates users by username and password. The clients talking to the API will android phones that have an internal app on it to get / send some data from / too the api.</p>
  
  <p>I have hashed passwords in the database with a salt. The connection between the client and the API will be SSL.</p>
  
  <p>Now on the website (MVC) I log users in by generating a new hash and matching this against the hash in the database.</p>
  
  <p>The some of the android devices will have a config file that locks the app to a specific user. Now I rather not store the password in plain text on the device and would like to encrypt the password.</p>
  
  <p>The question now is what would be the best practise here on comparing the hashed password. I dont think its save to just send the plain password to the API or is it?</p>