Authentication seems to have been implemented in
https://github.com/koreader/koreader/pull/1637
400 means bad request.
Authentication required would be indicated by the server with 401.
You could try adding a section to your settings file with something like the following. Careful, create a backup first!
Code:
authentications["hostname-or-ip"] = {
username = "enter-username-here",
password = "enter-password-here",
}
If that works then the server is broken.