This may be slightly OT but having the auth in the url has some benefits when using a handler for certain file types. The Android Browser violates this if you go to a site requires auth and then links to video/audio. When the media player is passed the url, the credentials are lost and the media fails to play.