2.1 Transport

Forms based authentication over HTTP messages are carried in the HTTP message headers ([RFC2616] section 4.2) and message body ([RFC2616] section 4.3).