title: Clear passwords set via java.net.Authenticator
body: <p>I'd like to add a 'sign out' feature to an application, and doing so requires forgetting all passwords.  Replacing the Authenticator seems to have no effect, as getPasswordAuthentication is not called again.  It seems that there is a cache of passwords, but I can't find it or a way of clearing it.  Here is a test case:</p>
  
  <pre><code>import java.net.*;
  import java.io.*;
  
  class Main {
      public static void main(String[] args) throws MalformedURLException, IOException {
          Authenticator.setDefault(new Authenticator() {
              public PasswordAuthentication getPasswordAuthentication() {
                  return new PasswordAuthentication("stack", "overflow".toCharArray());
              }
          });
  
          URLConnection connection = new URL("http://devio.us/~ricky/stackoverflow-protected/nothingtosee.html").openConnection();
          System.out.println(new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8")).readLine());
  
          Authenticator.setDefault(new Authenticator() {
              public PasswordAuthentication getPasswordAuthentication() {
                  return new PasswordAuthentication("no", "way".toCharArray());
              }
          });
  
          connection = new URL("http://devio.us/~ricky/stackoverflow-protected/nothingtosee.html").openConnection();
          System.out.println(new BufferedReader(new InputStreamReader(connection.getInputStream(), "UTF-8")).readLine());
  
          //This second line ideally should not succeed.  I.e., the results are &lt;html&gt;\n&lt;html&gt;, but only the first &lt;html&gt; should be seen.
      }
  }
  </code></pre>
  
  <p>The site is one I control and in case it disappears for any reason: stack/overflow is valid, no/way is not, using .htaccess. If you know of a more standard reference site feel free to alter my code or suggest a replacement.</p>