cyrus-imapd reports:
Unauthenticated HTTP requests no longer inherit authentication from the previous request on the same connection.