It's a farily simple setup. A .jar is hosted on a site which is protected by basic auth. I try to load the jar with an object tag - which works perfectly when tested without authentication. When the .jar is requested from the server, the basic auth header isn't included in the request. Why is this?