title: How to remove unwanted WWW-Authenticate headers
body: <p>From an MVC app, I'm sourcing an iCal subscription with authentication following the answer to this SO question:</p>
  
  <p><a href="https://stackoverflow.com/questions/10973751/serving-an-icalendar-file-in-aspnet-mvc-with-authentication">Serving an iCalendar file in ASPNET MVC with authentication</a></p>
  
  <p>The iCal stream is being created dynamically from events in the DB using the DDay.iCal library.</p>
  
  <p>This solution works fine on the local development server: both OSX Calendar and Outlook can subscribe to and receive updates from the app.</p>
  
  <p>However, on the shared server at my web host, the authentication fails for both Calendar and Outlook. That is, they both keep asking me for user &amp; password after the (correct) ones fail.</p>
  
  <p>EDIT: If I point a browser at the calendar URL it also fails authentication.</p>
  
  <p>EDIT: Getting weirder—Firefox authenticates and gets the iCal file. Safari, Chrome and IE fail authentication.</p>
  
  <p>If I point curl at the calendar URL with the same credentials I'm successful (i.e. I get the desired iCal file). And, of course, the same credentials can be used to login to the MVC app.</p>
  
  <p>EDIT — I think I know what's going on, but I don't know how to fix it. In my <code>OnAuthorization()</code> I add only <code>WWW-Authentication Basic</code> but with Fiddler I can see that three types of authentication are offered:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  WWW-Authenticate: Basic realm="Secure Calendar"
  WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM
  ... etc ...
  </code></pre>
  
  <p>At this point only Firefox responds with Basic Authorization, which succeeds.</p>
  
  <pre><code>GET &lt;&lt;URL&gt;&gt; HTTP/1.1
  ...
  Authorization: Basic &lt;&lt;encoded credentials&gt;&gt;
  </code></pre>
  
  <p>IE responds with Negotiate, which fails</p>
  
  <pre><code>GET &lt;&lt;URL&gt;&gt; HTTP/1.1
  ...
  Authorization Negotiate &lt;&lt;encoded stuff&gt;&gt;
  </code></pre>
  
  <p>Who is adding the other two and how can I make it stop? Here's more detail from the server response:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Cache-Control: private
  Transfer-Encoding: chunked
  Content-Type: text/html
  Server: Microsoft-IIS/7.5
  X-AspNetMvc-Version: 3.0
  WWW-Authenticate: Basic realm="Secure Calendar"
  X-AspNet-Version: 4.0.30319
  WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM
  X-Powered-By: ASP.NET
  X-Powered-By-Plesk: PleskWin
  Date: Tue, 23 Oct 2012 13:27:48 GMT
  </code></pre>
  
  <p>Thanks,
  Eric</p>