APM httpagent401 in clientless mode?

Session variable insertion isn't going to be automatic here. Only the 401 agent would do that. What you need to do is:

1. Respond with a 401 if the Authorization header does not exist.
2. If it does exist, but the MRHSession cookie does not, collect the payload and parse out the username and password from the Authorization header data and assign to temporary variables.

3. In the ACCESS_SESSION_STARTED event, grab those temporary values and insert into session variables. Example:

   when ACCESS_SESSION_STARTED {        
       if { [info exists username] } {            
           ACCESS::session data set session.logon.last.username $username
       }
   }        
   

I don't have a chance to test this, but the logic should at least be close.