HTTP responses are incredibly difficult to work with. I was under the impression that a login form should return 200, as the HTML page that loaded was indeed re

HTTP responses are incredibly difficult to work with. I was under the impression that a login form should return 200, as the HTML page that loaded was indeed returned OK. I can't find any documentation that actually says, and a lot of live websites don't seem to do one or the other consistently. You are right though, HTTP basic auth should have always returned some sort of salted hash. It was probably only omitted for simplicity.