Apologies, my Firefox was configured to supply an Authorization header from some previous testing, which came to light when it worked using Chrome.
I was sending AuthorizationBearer ym8MrzHMVXecPISBQPzW2nQJhboQ and got back: WWW-AuthenticateBasic realm="ASF Committers" Thanks, Lumus
