josh4trunks/core — pull request #2 by DamnDam (2014-01-23 11:58:36+00:00)
Title: Prefer session login name over HTTP login name

Your solution works well, and really helped me understand the problem here.
You will note that whatever password you provide, you will still clear the HTTP basic prompt and be logged in as long you give the right login name.

In fact, we have no business reauthenticating the user if the session credentials check out. It might matter somehow to be assured that two different vaild users are not trying to authenticate at the same time. So the goal here is to "reset" the HTTP basic credentials.

If so, it's just as easy, and not any less secure to simply reload the page and pass the correct login name to HTTP.