Got it. Thanks to Brian, too. I finally realized that you need an "options" object where you pass the method and headers.
function myFunction() {
var url = "https://swellpath.harvestapp.com/people/";
var user = "dude@dude.com";
var password = "supersecurepw";
var headers = {
"Accept": "application/xml",
"Content-Type": "application/xml",
"Authorization": "Basic "+ Utilities.base64Encode(user+":"+password)
};
var options = {
"method" : "get",
"headers" : headers
};
var response = UrlFetchApp.fetch(url,options);
Logger.log(response);
}