I agree, and the practice of sending an Authorization header without first receiving a challenge is common enough that there's a phrase for it: preemptive authe

I agree, and the practice of sending an Authorization header without first receiving a challenge is common enough that there's a phrase for it: preemptive authentication. See, for example, the Apache HttpClient documentation: http://hc.apache.org/httpclient-legacy/authentication.html#Preemptive_Authentication http://hc.apache.org/httpclient-legacy/authentication.html#P...