I haven't seen that myself, but knowing the way it works, I'd imagine it's coming up because of the underlying AJAX calls to the service. We want the service to be callable by specifying http credentials, but we don't want that window to popup when using a browser. Hmm......