The ScriptableHTTPRequest object requires you to pass a username & password in the open() method. You can pass them as empty strings if you don’t use them:
Some documentation on the ScriptableHTTPRequest would be great, because others than stated in the docs, it doesn’t really resemble the XMLHttpRequest ,and the context completion doesn’t work for this.