start a repl pair. then from a separate ip address (not localhost), try hitting the web interface for each half of the pair. one half of the pair will let one in without any auth, the other half will ask for auth