This bug happens both remote and localhost.

To repro:
---------
1. Configure single server with --rest and --auth.
2. Add a user to the admin Database.
> use admin
> db.addUser("theadmin", "anadminpassword")
3. Connect to HTTP UI from
3.a. local : http://localhost:28017
3.b. remote : http://1.2.3.4:28017

According to the documentation 3.a. should work and 3.b. should ask for authentication.
This works correctly.
http://www.mongodb.org/display/DOCS/Http+Interface#HttpInterface-HTTPConsoleSecurity

4. Use an admin-level command from the HTTP UI
4.a. local: http://localhost:28017/listDatabases
4.b. remote: http://1.2.3.4:28017/listDatabases

In both cases MongoDB is throwing the following exception:
"error loading page: unauthorized db:admin lock type:-1 client:(NONE)"

In the case of 4.a, no authentication request is made, the http request simply fails.