I thought for digest auth, it the server sends a new nonce, and then asks for md5(md5(username:password):nonce:md5(something i forget)) - you couldn't verify th

I thought for digest auth, it the server sends a new nonce, and then asks for md5(md5(username:password):nonce:md5(something i forget)) - you couldn't verify that unless you had access to the raw password, no? summon @tpateck