[tarka]

I've found it... in Richard Claytons document there is the following snippet...

"Sites that use \basic auth" (RFC 1945 et seq.) will be ignored, viz: sites where the browser
remembers a user name and password and supplies it with each request to avoid the need
to log in again."

So any website that does not use HTTP basic auth (which lets face it, is pretty much all websites these days) will have password protected content profiled anyway.