maybe test here that the URL returns 401 if user/pass not provided? we had a bug like this a while back