AJAX call web service behind ISA / TMG firewall with authentication

To be able to call web service behind ISA / TMG firewall, a few conditions need to be met:
1. use beforeSend when making the service call:

 $.ajax({
    url: weburl,
    beforeSend: function (xhr) { xhr.setRequestHeader ("Authorization", "Basic xxx"); }, 
    type: "POST",
    dataType: "xml",
    data: soapEnv,
    complete: processResult,
    contentType: "text/xml; charset=\"utf-8\""
   });

2. Basic authentication needs to be enabled on both ISA / TMG and IIS.
3. Enable keberos authentication for the published web app.
4. disable loopback check on the web server.