In my own case I use os.popen("wget ...") instead of urllib2 just because some version long ago failed on some web site.  I can trust that this external tool works all the time.  It would be great if urllib2 worked as well nowadays.

So my opinion on this issue, as a mere user, is that it is purely a bug which Python 2.7 should fix it, and it should do so in a transparent way.  Adding some new class that can only be found by careful reading of the latest version of the docs is useless: people will instead blame urllib2 as a whole and switch to something else.

Can someone confirm how common browser (one is enough) deal with it?  If they also send the authorization headers in the initial request, then I really, really don't see why urllib2 shouldn't by default.