Listing the available layers works with the authentication and using a HTTP caller to the getcapabilites with the authentication works. It's just when the reader is running.
It would be great if there was a way to capture the HTTP(S) request and responses.