BlobMessage and authentication

I'm able to use BlobMessage to transfer large files, but run into a problem
if the 'out of band' mechanism requires authentication.

For example, when I send a BlobMessage with url =
"http://fileserver:8080/bigFile.dat" I can read the input stream at the
consumer end just fine. When the http server is set up to require
authentication I get an exception because the
DefaultBlobDownloadStrategy.getInputStream() isn't authenticated and sees a
401 error.

There's no way to specify the credentials in the BlobMessage, and while URLs
of the form http://username:password [ at ] fileserver:8080/bigFile.dat work in
(some) browsers, they don't work in a BlobMessage.

Is use of authentication on out of band mechanisms (http and ftp)
unsupported? I considered writing my own AuthenticatingBlobDownloadStrategy
but it's unclear how to replace the default one.

Any clues?

Thanks,
-Adrian