Someone messed up a directory permission on the server and made it HTML authenticated.