If someone knows that you're using CardDAV on api.oasis.sandstorm.io and you're unlucky enough to have entered the basic auth thing into your browser, and therefore it remembers it,