No, that's not his proposal. The 401 message (which is what he meant to say) is what prompts the browser to display the popup box in the first place. The idea

No, that's not his proposal. The 401 message (which is what he meant to say) is what prompts the browser to display the popup box in the first place. The idea would be that if you provide a custom form there, the browser displays your custom form (in the browser window) in place of the default popup. Then all you need to add is a couple of Javascript methods to allow that custom form to set the HTTP Auth parameters and retry (you could even use a special form target for that, if you wanted to, avoiding Javascript entirely).