All that should be required for new platforms is to implement a 'run' function that creates a window that hosts an HTML control and queries determine_state_url() and determine_exit_state() once a second.
Using the formal HTTP authentication scheme was too cumbersome and I couldn't pre-fill out that information as part of the request. IE11 emulation ignores any credentials as part of the URI. The web browser control insists on displaying a credentials dialog when challenged.
So for now, look for a 'secret' header which just contains a thread identifier.
Authentication is skipped if the app was started with the --debug command line argument. You'll be able to attach and debug your HTML application via the port number written in the Window title.