How do you get the browser to send the Authentication header for every request thereafter? Typically you Auth once, and set cookies which the browser sends automatically with each HTTP request, even if the user is not on your domain.

You would have to rewrite HTML5 and handle all HTTP traffic manually to set the Authentication header for every request. OP's trick of HTTP + ancient browser spec for handling basic auth triggers automatic sending of the Auth header for all requests.