The CreateDefault method does not set a URLSecurityManager, so the code will
fall-back to disabling all built-in authentication. Instead, use the default
URLSecurityManager which will use IE Security Zones on Windows to determine
whether a URL is part of the Local Intranet zone or on non-Windows, default
proxy rules will be used (i.e. would a default proxy map vs. connect direct).