Very Little from the spec states if not, and often You can not make use of a 401 in that predicament because returning a 401 is just authorized when you contain a WWW-Authenticate header. Being a hacker, it is possible to do the job for an MSSP, supplying them a http://pigpgs.com