> but still dls the non-subscription site.  The url
> properly reflects user and password. 
You don't tell us the site so it's hard to tell.
When you browse to a protected link does your browser pop up a
username/password box? That's HTTP authentication.

If you have to fill in a form on a page, that's Form-based authentication.

See <http://httrack.kauler.com/help/Authentication>

Also remember to filter out the log-out url or httrack will log itself out.