I kind of get what you are saying, but I don't understand why it needs to do testConnection to see if auth is required. Surely its easy to see if auth is required by seeing if the server address is HTTP or HTTPS (where HTTPS requires auth)? 

For the second testConnection request, are we thinking that for every request attempt, we've got to

1) testConnection (or just look at the server address?) to figure out if it needs credentials or not,
2) If it does, get the credentials and save them in a class wide variable (until we get nsILoginManager to work)
3) and then testConnection again to confirm it works?

Well we can definitely switch how the credentials are being stored, (i.e. from being passed in a return value to be stored in a 'global' variable), I'm just not completely understanding the need for 1) and as 1) is done by seeing the server address. I can see the need for 3), as it adds that extra little bit of "cautionary" programming. 

Could to elaborate on the needs for 1)? 

Thanks, Jon.