There's no handling here of alternate challenges or tracking realms (see [RFC 2617](http://www.rfc-editor.org/rfc/rfc2617.txt)).  This means a trivially recoverable password may be sent over an insecure link.  For example, the server may give a challenge for Digest which would otherwise be secure even over HTTP, but we respond with a base64 encoded password revealing the secret.

Mechanize implements RFC 2617 correctly with respect to challenges and realms, I think we'll need to import some of that code.  (License should be OK because I wrote the Mechanize code to do this.  This also means I need to resume work on an HTTP user-agent for ruby.)