I'm taking about using the 'Authentication: ' headers, not relying on the browser's handling of auth (other than making the requests).