I loaded gadget page (all gadgets) on my iphone.  It prompted for login/pw.  I logged in, and it worked fine.
 
I navigated to another page, cambe back, and now when I try to load the page it says "HTTP Status 500 Malformed header specified.
 
I just tried the Campaign Results only gadget page and I'm geting the same malformed header error.
 
Any ideas?  Is browser not caching the authentication properly.

So whats happening is that mobile safari (the browser on the iphone) is not sending the Authorization header on subsequent requests.  Unfortunately tomcat is sending a cookie that lets it think the browser is authenticated.
 
No other browsers seem to do that.
 
So its a bug specific to mobile safari and the hack way we're doing authentication.