r58207 and r58247 patch logic is reversed.  I noticed this when I
tried to use urllib to retrieve a file which required auth.

Fix that and add a test for 401 error to verify.