I admit, this makes me uncomfortable - is there any way that defining a realm file over http can be used to hijack a user? @fmarier or @warner, can we get your opinions here?