Blob pw;         /* The user password prefixed by the nonce */
  Blob payload;    /* The HTTP request payload */
  Blob hdr;        /* The HTTP request header */
  const char *zSep;
  int i;
  int cnt = 0;


  /* Compute the login card.  This card is of the form:
  **
  **      login USERID NONCE SIGNATURE
  **
  ** The NONCE is a unique string - never to be reused.  In this case,
  ** the nonce is the SHA1 hash of the rest of the payload.  The SIGNATURE
  ** is the SHA1 hash of the NONCE and the user password concatenated.
  */


  blob_zero(&nonce);
  blob_zero(&pw);
  sha1sum_blob(pSend, &nonce);
  blob_copy(&pw, &nonce);
  blob_zero(&login);
  if( g.urlUser==0 ){
    user_select();
    db_blob(&pw, "SELECT pw FROM user WHERE uid=%d", g.userUid);
    sha1sum_blob(&pw, &sig);
    blob_appendf(&login, "login %s %b %b\n", g.zLogin, &nonce, &sig);
  }else{
    if( g.urlPasswd==0 ){
      if( strcmp(g.urlUser,"anonymous")!=0 ){
        char *zPrompt = mprintf("password for %s: ", g.urlUser);
        Blob x;
        prompt_for_password(zPrompt, &x, 0);
        free(zPrompt);
        g.urlPasswd = blob_str(&x);
      }else{
        g.urlPasswd = "";
      }
    }
    blob_append(&pw, g.urlPasswd, -1);
    /* printf("presig=[%s]\n", blob_str(&pw)); */
    sha1sum_blob(&pw, &sig);
    blob_appendf(&login, "login %s %b %b\n", g.urlUser, &nonce, &sig);
  }        
  blob_reset(&nonce);
  blob_reset(&pw);
  blob_reset(&sig);




  /* Construct the payload, which includes the login card.
  */
  if( g.fHttpSecure && g.urlPasswd[0] ){
    blob_compress(pSend, pSend);
    payload = login;
    blob_encrypt(pSend, g.urlPasswd, &payload);