Why is this necessary?

All content that requires authentication via the proxy server is licensed to the University by commercial vendors who require that we limit access to current students, faculty, and staff of the University.

An industry has sprung up around the world of large-scale piracy of this vendor content via University connections. Pirates obtain authentication credentials—like PIDs— share them on websites, and download entire runs of journal articles with the stolen credentials. When the vendors detect this piracy, they completely shut off access to their resources to all users from the compromised University.

PIDs are considered public information. So we must use secure authentication methods with a password that is known only to the rightful user.