It's not clear what's happening. On the good response (HTTP_200), you
send an Authorization challenge. On the second request, you don't send
a response. Normally, I'd say that's because your realm doesn't match.
But when you don't set a realm, it sends an Authorization to every
response. Is it possible you have a global siegerc file and a
$HOME/.siegerc file and you're not using the configuration you think
you are?
What happens if you add a realm? login=user:pass:ASP QFSI