Introduce a magic querystring based auth variable, instead of the HTTP authorisation header, for downloading definitions (since we cannot write the HTTP header in with anything the browser gives us).
merge bug25536 into stable
merge stable into default