Use the HTTPPasswordMgrWithDefaultRealm to limit HTTP credentials to the requested resource and any descendants