Doh! Of course ... I had a note on my list about favicon showing the wrong thing, and of course it was showing the wrong thing on my logged in system precisely because of this!

>Most likely, the authentication request appears due to your
>browser doing automatic requests to /favicon.ico or something
>like.

I can't test it at present but I'm certain this will be the problem, It makes me think that perhaps my config is a little dangerous so now I know the approach is correct, I'll perhaps swap things around so that I can keep / unprotected completely just in case and add the auth for known paths to the couch back end. That should work fine in my case as I only have a couple of databases to secure.

Many thanks Maxim!

Roger