TLS isn't up to the job without better credential protection says RFC

HTTP needs to SCRAM - the Salted Challenge Response Authentication Mechanism

As part of the long process to make the Internet more secure, user credentials need better protection than the transaction layer security (TLS) standard."