[ldolse]

That did the trick. I think in the end it might have been the content disposition header. Even after I'd disabled 401 auth for Droid user agents the 2.3 beta still failed to download (just hung), and Google's download manager titled the download <unknown>.

With this new release the download has the proper name and the download completes, launching Aldiko upon completion. I saw content-disposition was added in the release notes.

The authentication worked flawlessly as well, apparently the server admins were wise enough not to configure cpanel to use MD5.

Thanks!