via BASIC or DIGEST auth - this clears the client IP from the login attempt
list (as is supposed to happen).
Currently, the JS "login" method does not do this (and a JS login failure does
not get added to the login attempt list).