Well, basic authentication is supported by PD4ML, so you may always use
[language=java:3s5g2c6o]Map m = new HashMap();
m.put(PD4Constants.PD4ML_BASIC_AUTHENTICATION, “login:password”);
and it is quite safe to use, as the base64-encoded password does not leave the server side in the scenario.

But the trick with iv-user HTTP header is still not clear to me. As I can imagine, MS Internet Explorer never sets such proprietary HTTP header. How does it request for images after HTML is loaded?