Review and changes from Jocelyn Fiat

to my understanding ... it is enough to raise the auth challenge on /login uri for instance
and then on other page just checking for the Authorization: header .. and see if this is basic or digest .... to check if credentials are valid