Well, I don't know if it's broken or not in v213, but the access protection works fine here on v214. Note that the URL will be different in v214, http://10.1.5.30?FID=101&EXT=.xml

Cheers