[gears-users] httpRequest webservice??

[Nemisis]

Hi all, i am very new to gears and have just started developing an
offline app using this technology, so far i am finding it very good,
but have come across something that i just dont get, and was hoping
someone could help me.

I am developing an application that users can use online and offline.
While online they can download the latest data locally, so when they
are offline, this data can be used.

To download the data i am using Webservices, developed in Visual
Studio 2008.  The webservices return json data which seems to work
very well at the moment.  The code i am using to connect to my
webservices is like this.

this.downloadData = function() {
        var workerPool = google.gears.factory.create
('beta.workerpool', '1.0');

        workerPool.onmessage = function(a, b, messageObject) {

            var request = google.gears.factory.create
('beta.httprequest', '1.0');
            request.open('GET, 'Service1.svc/GetData');
            request.setRequestHeader("Content-type", "application/x-
www-form-urlencoded");

            request.onreadystatechange = function() {
                if (request.readyState == 4) {
                    var str = request.responseText.slice(5,
request.responseText.length - 1);
                    var json = eval('(' + str + ')');

                    db.open();
                    db.addDataToLocalDatabase(json);
                    db.close();
                }
            }

            request.send();
        }

        var childWorkerId = workerPool.createWorkerFromUrl('../Scripts/
downloadWorker.js');

        workerPool.sendMessage('message to download', childWorkerId);

    }

I gather this code is ok?  This connects to my svc webservice and gets
the data. Wicked!

But....  I want to pass a username and maybe a password to my
webservice as this data shouldnt be available to everyone.  How do i
pass the data to the webservice securely?!  In server side code you
can create a soapHeader to pass data, but i have never done it, plus
since i am doing this clientside, how can i make it secure?

Thanks in advanced, probably a basic question, but i know someone will
know the answer lol