I'm having a discussion with a client and what the client says doesn't
seem to be possible, so I'm going through it out there and see if maybe
I'm mistaken in my understanding of how an applet does its thing.  

The basic issue is that there is a PHP script that requires
authentication.  I'm assuming they mean HTTP basic authentication since
nobody can seem to give me any other details.  Then I have an applet that
I wrote that is intended to POST some data to the script.  It doesn't do
anything to authenticate to the script.  It doesn't pass any cookies or
security tokens explicitly.  

The client says this works, but I can't replicate his results from here.  
I'm also not sure his test is really valid.  

The only way this could possibly work is if the JVM picks up security
tokens from the browser when it makes its HTTP connection.  I don't think
it does this.  Am I incorrect here?  Is the JVM quietly taking care of
using the correct security tokens?  

Thanks.