I'm not sure it's okay for a HEAD request to login to return the status code 200 while not doing any logging in. Maybe it could return 405 (Method Not Allowed) just to make explicit the fact that HEAD does not log in ?