save the code I was working on cause I'm throwing it away.  SRP would require javascript crypto and there doesn't appear to be any real secure base from which to work in the browser so its best to rely on digest authentication, well known, secure _enough_ and now figured out how to get Authorized headers past the mod_fcgid blockade on dreamhost
back to desktop