AFAIK, that is the way HTTP BASIC AUTH was designed to work. It allows all authenticate state to be kept in the client; but it also means you should make sure that all of your requests, not just the first authentication, go over SSL.
[Message sent by forum member 'monzillo' (ronald.monzillo_at_sun.com)]
http://forums.java.net/jive/thread.jspa?messageID=385871