[tzahola]

You only need TLS for that. HTTP adds nothing security-wise.

[paulddraper]

It adds Authorization, WWW-Authenticate, Proxy-Authentication, Proxy-Authenticate, Cache-Control, but those aren't even used that consistently.