One more thing, I think the same dialog should pop up when we receive a 401 error (with bearer authorization request) from MB. The password dialog would be only used for non-MB sites. But this is something I have been reluctant before some XmlWebService refactoring.