The CMIS spec recommends the support of WS-Security UserName Tokens for the Web Services binding and HTTP Basic Authentication + TLS for the AtomPub binding. We should have a similar recommendation for the Browser binding. HTTP Basic Authentication + TLS seems to be a good fit.