title: Chrome: How to get ajax request to work with kerberos if not already authenticated
body: <p>We have a REST API secured using Kerberos.  Hosted elsewhere is a webapp that calls this API.</p>
  
  <p>If you navigate directly to the API, then the authentication works fine and a cookie is returned.  Then the webapp works just fine since it has a cookie for API's root URI.</p>
  
  <p>However if you navigate to the webapp and it makes an <code>HTTP GET</code> request to the API using AJAX, then the request returns <code>401: Unauthorized</code> as well as <code>WWW-Authenticate:Negotiate</code>.  If I navigate to the same address, chrome would negotiate and get authenticated, but in this case it stops at this point.</p>
  
  <p>There are various ugly hacks to get around the problem, like creating an IFRAME that sources some part of the API, or redirecting the user to the API and having it bounce the user back using a 307, but these are clearly not optimal.</p>
  
  <p>It works fine in IE7.</p>
  
  <p>What is the correct way to deal with this?</p>