PHP cURL Basic Authentication Alternatives for CURLOPT_HTTPHEADER & CURLOPT_USERPWD...?
What makes you think CURLOPT_HTTPHEADER is disabled for security reasons?
It accepts an array rather than a string. Try this instead:
curl_setopt($data, CURLOPT_HTTPHEADER, array( "Authorization: Basic " . base64_encode($username . ":" . $password)));