I believe there is some protocol authentication that Windows caches to avoid having to re-authenticate on each request.  In cases where there is a long delay in answering, or another machine is used, the challange/response can then be re-authenticated without the app knowing.

 Hope this helps,

Scott

Thanks for responding Scott.  If you get a moment please see this post --> http://forums.iis.net/thread/1400634.aspx