Well, basic authentication is supported by PD4ML, so you may always use
[language=java:3s5g2c6o]Map m = new HashMap();
and it is quite safe to use, as the base64-encoded password does not leave the server side in the scenario.
But the trick with iv-user HTTP header is still not clear to me. As I can imagine, MS Internet Explorer never sets such proprietary HTTP header. How does it request for images after HTML is loaded?