(In reply to comment #11)
> Okay. I found the problem. It's me. All is my fault.
> The "domain" key in the response header is wrongly used by me. neon is very
> correct about its semantics.
[...]
> I don't know how I managed to configure Apache to send that key. Again: My
> bad. Next beer is on me.

Good that you found the explanation. I'll happily accept that beer, should we
ever meet ;-)

I've filed a separate feature request (bug?) for the "Basic Auth over http":
bug #57248. Is that something that you would expect in a 1.3.x maintenance
release?