Can you check if you are sending the "X-Requested-With" header with value "XMLHttpRequest" ?

When this header is set PL does not returns a 401 status code, but a 403. This helps to bypass this basic dialog box in some browsers.