--- curl.orig/lib/http_ntlm.c	2003-06-13 17:58:47.000000000 +1000
+++ curl/lib/http_ntlm.c	2003-06-13 17:58:22.000000000 +1000
@@ -368,7 +368,8 @@
       return CURLE_OUT_OF_MEMORY; /* FIX TODO */
   }
   else {
-    /* We are not in the first state, create a type-3 message */
+    if(NTLMSTATE_TYPE2 == data->state.ntlm.state) {
+      /* We received the type-2 already, create a type-3 message */
 
     /*
       My test-IE session sent this type-3:
@@ -558,6 +559,17 @@
     else
       return CURLE_OUT_OF_MEMORY; /* FIX TODO */
 
+      data->state.ntlm.state = NTLMSTATE_TYPE3; /* we sent a type-3 */
+
+    } else 
+      if(NTLMSTATE_TYPE3 == data->state.ntlm.state) {
+        /* connection is already authenticated,
+         * don't send a header in future requests */
+          if(conn->allocptr.userpwd) {
+            free(conn->allocptr.userpwd);
+            conn->allocptr.userpwd=NULL;
+          }
+      }
   }
 
   return CURLE_OK;