Ah well, it turned out to be fairly easy to work around, at least. :-)

Just in case any other urllib2 users have to deal with this in 2.6.6 (and also manage to find their way to this bug report :-):  it's easy to monkeypatch your way around the problem.  E.g.:

import sys
import urllib2

if sys.version_info[:2] == (2, 6) and sys.version_info[2] >= 6:
    def fixed_http_error_401(self, req, fp, code, msg, headers):
        url = req.get_full_url()
        response = self.http_error_auth_reqed('www-authenticate',
                                          url, req, headers)
        self.retried = 0
        return response

    urllib2.HTTPBasicAuthHandler.http_error_401 = fixed_http_error_401