ACR can now require use of a remoteAPIKey on sparql (all resteasy) calls and we intend to run that way for 1.0. VA code needs to be updated to allow the remoteAPIKey to be set on the server (per ACR instance) and sent. The ACR also supports anonymous access. The new ACRCommon.jar library has code that will do both (send remoteAPIKey and try to login as anonymous and let your code know the result so you can avoid showing a password screen if it works). It may be easy to plug that in. If not, the DataAccess class is still a good example to see what is sent for GET and POST calls. (https://opensource.ncsa.illinois.edu/stash/projects/MED/repos/mmdb-gwt/browse/ACRCommon/src/org/sead/acr/common/DataAccess.java?at=refs%2Fheads%2Fsead-1.2)