Try this:
Code:
Set peTransferFlags to ifSecure
then run again and look at the headers.

IIR, this property is what determines if the username and password are included. I could be wrong; it was long ago, and I am getting older.