I've a feeling this may not be doable but:

.NET Web Api application with our own message handlers for Authentication and CORS.

We are using Digest authentication and, for testing purposes, we are hoping to enable cross server requests. Where no authentication is required cross server works OK - however when authentication IS required the browser does not respond to the challenge.

Sequence of events:
Browser sends 'OPTIONS' request.
Server responds allowing access.
Browser resubmits.
Server detects authentication requirement and issues challenge.
Browser receives the 401 but doesn't respond (I'd expect the browser login window to pop up)

Any suggestions ?