 +            if expected == response:
 +                return True
  
-+        # And yet another IE hack...
-+        # IE refuses to send Authorization headers with REPORT requests.
-+        # So instead we're sending a POST, then telling the server it's a REPORT.
-+        # When this happens, the client created the response with POST and the server
-+        # compares it against a response made with REPORT, which of course won't match.
++        # We allow other methods to tunnel through using POST and a request header.
++        # (See http://code.google.com/apis/gdata/docs/2.0/basics.html)
++        # In that case, the client will have created the response with a method of POST,
++        # but the server compares that to a response make with a different method.
 +        # So we try again telling the server to use POST instead.
-+        if self.method == "REPORT":
++        expected = calcResponse(
++            calcHA1(algo, self.username, self.realm, password, nonce, cnonce),
++            algo, nonce, nc, cnonce, qop, "POST", uri, None
++        )
++        if expected == response:
++            return True
++        if nc is not None or cnonce is not None:
 +            expected = calcResponse(
 +                calcHA1(algo, self.username, self.realm, password, nonce, cnonce),
-+                algo, nonce, nc, cnonce, qop, "POST", uri, None
++                algo, nonce, None, None, qop, "POST", uri, None
 +            )
 +            if expected == response:
 +                return True
-+            if nc is not None or cnonce is not None:
-+                expected = calcResponse(
-+                    calcHA1(algo, self.username, self.realm, password, nonce, cnonce),
-+                    algo, nonce, None, None, qop, "POST", uri, None
-+                )
-+                if expected == response:
-+                    return True
 +
 +        return False
 +
      def checkHash(self, digestHash):
          response = self.fields.get('response')
          uri = self.fields.get('uri')
-@@ -228,9 +272,9 @@
+@@ -228,9 +270,9 @@
          # Now, what we do is encode the nonce, client ip and a timestamp
          # in the opaque value with a suitable digest
          key = "%s,%s,%s" % (nonce, clientip, str(int(self._getTime())))

         username = auth.get('username')
         if not username:
             raise error.LoginFailed('Invalid response, no username given.')
@@ -342,7 +387,7 @@
                              auth.get('nonce'),
                              request.remoteAddr.host):
 

 
     def verifyOpaque(self, opaque, nonce, clientip):
         """
@@ -274,7 +316,7 @@
                 'Invalid response, incompatible opaque/nonce too old')
 
         # Verify the digest
