Practically Nothing in the spec states normally, and infrequently You cannot use a 401 in that predicament because returning a 401 is just lawful should you include a WWW-Authenticate header. They're able to use spyware and infostealers to harvest passwords or trick customers into sharing login facts by means of http://pigpgs.com