Still true when I tested last year. The core protocol does not have a defined way to get the browser to forget the login. You have to resort to different fudge

Still true when I tested last year. The core protocol does not have a defined way to get the browser to forget the login. You have to resort to different fudges on different browser. Net/Net: the http auth ui sucks, has bad usability, weak crypto, and is not robust with logout. HTML/form based auth can be made robust and is a preferable alternative in every case.