Detect ip of client?

Why not using HTTP authentication and checking the client's password at every request?