I just created a password protected podcast (using HTTP authentication). The mp4 file downloads via https, and due to SSL/Virtual Hosting, the URL is redirected immediately upon request (via mod_rewrite).
I'm positive that SSL is being used when the file is downloaded (as I've set the download script not to execute unless the request is made via https). When I access the file Safari, it says the password will be sent securely, but when I access via iTunes (via a podcast subscription), it says it will be sent in the clear.
Has anyone else seen this bug?