diff -r 93b982ccede2 -r 5daf16870df6 src/network/access/qhttpnetworkconnection.cpp
--- a/src/network/access/qhttpnetworkconnection.cpp	Mon Jun 21 22:38:13 2010 +0100
+++ b/src/network/access/qhttpnetworkconnection.cpp	Thu Jul 22 16:41:55 2010 +0100
@@ -343,9 +343,16 @@
                 copyCredentials(i,  auth, isProxy);
                 QMetaObject::invokeMethod(q, "_q_restartAuthPendingRequests", Qt::QueuedConnection);
             }
+        } else if (priv->phase == QAuthenticatorPrivate::Start) {
+            // If the url's authenticator has a 'user' set we will end up here (phase is only set to 'Done' by
+            // parseHttpResponse above if 'user' is empty). So if credentials were supplied with the request,
+            // such as in the case of an XMLHttpRequest, this is our only opportunity to cache them.
+            emit q->cacheCredentials(reply->request(), auth, q);
         }
-        // changing values in QAuthenticator will reset the 'phase'
-        if (priv->phase == QAuthenticatorPrivate::Done) {
+        // - Changing values in QAuthenticator will reset the 'phase'.
+        // - If withCredentials has been set to false (e.g. by QtWebKit for a cross-origin XMLHttpRequest) then
+        //   we need to bail out if authentication is required.
+        if (priv->phase == QAuthenticatorPrivate::Done || !reply->request().withCredentials()) {
             // authentication is cancelled, send the current contents to the user.
             emit channels[i].reply->headerChanged();
             emit channels[i].reply->readyRead();
@@ -489,7 +496,11 @@
 
     int i = indexOf(socket);
 
-    if (! (defaultPipelineLength - channels[i].alreadyPipelinedRequests.length() >= 2)) {
+    // return fast if there was no reply right now processed
+    if (channels[i].reply == 0)
+        return;
+
+    if (! (defaultPipelineLength - channels[i].alreadyPipelinedRequests.length() >= defaultRePipelineLength)) {
         return;
     }
 
@@ -712,6 +723,7 @@
 
 // This function must be called from the event loop. The only
 // exception is documented in QHttpNetworkConnectionPrivate::queueRequest
+// although it is called _q_startNextRequest, it will actually start multiple requests when possible
 void QHttpNetworkConnectionPrivate::_q_startNextRequest()
 {
     //resend the necessary ones.
@@ -729,26 +741,23 @@
 
     // dequeue new ones
 
-    QAbstractSocket *socket = 0;
+    // return fast if there is nothing to do
+    if (highPriorityQueue.isEmpty() && lowPriorityQueue.isEmpty())
+        return;
+    // try to get a free AND connected socket
     for (int i = 0; i < channelCount; ++i) {
-        QAbstractSocket *chSocket = channels[i].socket;
-        // try to get a free AND connected socket
         if (!channels[i].isSocketBusy() && channels[i].socket->state() == QAbstractSocket::ConnectedState) {
-            socket = chSocket;
-            dequeueAndSendRequest(socket);
-            break;
+            dequeueAndSendRequest(channels[i].socket);
         }
     }
 
-    if (!socket) {
-        for (int i = 0; i < channelCount; ++i) {
-            QAbstractSocket *chSocket = channels[i].socket;
-            // try to get a free unconnected socket
-            if (!channels[i].isSocketBusy()) {
-                socket = chSocket;
-                dequeueAndSendRequest(socket);
-                break;
-            }
+    // return fast if there is nothing to do
+    if (highPriorityQueue.isEmpty() && lowPriorityQueue.isEmpty())
+        return;
+    // try to get a free unconnected socket
+    for (int i = 0; i < channelCount; ++i) {
+        if (!channels[i].isSocketBusy()) {
+            dequeueAndSendRequest(channels[i].socket);
         }
     }