diff --git a/dll/win32/wininet/cookie.c b/dll/win32/wininet/cookie.c
index 60b8335639a..2af752110c0 100644
--- a/dll/win32/wininet/cookie.c
+++ b/dll/win32/wininet/cookie.c
@@ -151,18 +151,18 @@ static WCHAR *create_cookie_url(substr_t domain, substr_t path, substr_t *ret_pa
 
     static const WCHAR cookie_prefix[] = {'C','o','o','k','i','e',':'};
 
-    user_len = sizeof(user)/sizeof(WCHAR);
+    user_len = ARRAY_SIZE(user);
     if(!GetUserNameW(user, &user_len))
         return FALSE;
     user_len--;
 
-    len = sizeof(cookie_prefix)/sizeof(WCHAR) + user_len + 1 /* @ */ + domain.len + path.len;
+    len = ARRAY_SIZE(cookie_prefix) + user_len + 1 /* @ */ + domain.len + path.len;
     url = heap_alloc((len+1) * sizeof(WCHAR));
     if(!url)
         return NULL;
 
     memcpy(url, cookie_prefix, sizeof(cookie_prefix));
-    p = url + sizeof(cookie_prefix)/sizeof(WCHAR);
+    p = url + ARRAY_SIZE(cookie_prefix);
 
     memcpy(p, user, user_len*sizeof(WCHAR));
     p += user_len;
@@ -238,7 +238,7 @@ static cookie_t *alloc_cookie(substr_t name, substr_t data, FILETIME expiry, FIL
 {
     cookie_t *new_cookie;
 
-    new_cookie = heap_alloc(sizeof(*new_cookie));
+    new_cookie = heap_alloc_zero(sizeof(*new_cookie));
     if(!new_cookie)
         return NULL;
 
@@ -247,9 +247,12 @@ static cookie_t *alloc_cookie(substr_t name, substr_t data, FILETIME expiry, FIL
     new_cookie->flags = flags;
     list_init(&new_cookie->entry);
 
-    new_cookie->name = heap_strndupW(name.str, name.len);
-    new_cookie->data = heap_strndupW(data.str, data.len);
-    if(!new_cookie->name || !new_cookie->data) {
+    if(name.str && !(new_cookie->name = heap_strndupW(name.str, name.len))) {
+        delete_cookie(new_cookie);
+        return NULL;
+    }
+
+    if(data.str && !(new_cookie->data = heap_strndupW(data.str, data.len))) {
         delete_cookie(new_cookie);
         return NULL;
     }
@@ -658,7 +661,7 @@ DWORD get_cookie_header(const WCHAR *host, const WCHAR *path, WCHAR **ret)
         ptr = header = heap_alloc(sizeof(cookieW) + (cookie_set.string_len + 3 /* crlf0 */) * sizeof(WCHAR));
         if(header) {
             memcpy(ptr, cookieW, sizeof(cookieW));
-            ptr += sizeof(cookieW)/sizeof(*cookieW);
+            ptr += ARRAY_SIZE(cookieW);
 
             cookie_set_to_string(&cookie_set, ptr);
             heap_free(cookie_set.cookies);
@@ -730,7 +733,7 @@ BOOL WINAPI InternetGetCookieExW(LPCWSTR lpszUrl, LPCWSTR lpszCookieName,
 
     TRACE("(%s, %s, %p, %p, %x, %p)\n", debugstr_w(lpszUrl),debugstr_w(lpszCookieName), lpCookieData, lpdwSize, flags, reserved);
 
-    if (flags)
+    if (flags & ~INTERNET_COOKIE_HTTPONLY)
         FIXME("flags 0x%08x not supported\n", flags);
 
     if (!lpszUrl)
@@ -949,7 +952,7 @@ DWORD set_cookie(substr_t domain, substr_t path, substr_t name, substr_t data, D
         if(!(end_ptr = memchrW(data.str, ';', data.len)))
             end_ptr = data.str + data.len;
 
-        if(data.len >= (len = sizeof(szDomain)/sizeof(WCHAR)) && !strncmpiW(data.str, szDomain, len)) {
+        if(data.len >= (len = ARRAY_SIZE(szDomain)) && !strncmpiW(data.str, szDomain, len)) {
             substr_skip(&data, len);
 
             if(data.len && *data.str == '.')
@@ -960,17 +963,17 @@ DWORD set_cookie(substr_t domain, substr_t path, substr_t name, substr_t data, D
 
             domain = substr(data.str, end_ptr-data.str);
             TRACE("Parsing new domain %s\n", debugstr_wn(domain.str, domain.len));
-        }else if(data.len >= (len = sizeof(szPath)/sizeof(WCHAR)) && !strncmpiW(data.str, szPath, len)) {
+        }else if(data.len >= (len = ARRAY_SIZE(szPath)) && !strncmpiW(data.str, szPath, len)) {
             substr_skip(&data, len);
             path = substr(data.str, end_ptr - data.str);
             TRACE("Parsing new path %s\n", debugstr_wn(path.str, path.len));
-        }else if(data.len >= (len = sizeof(szExpires)/sizeof(WCHAR)) && !strncmpiW(data.str, szExpires, len)) {
+        }else if(data.len >= (len = ARRAY_SIZE(szExpires)) && !strncmpiW(data.str, szExpires, len)) {
             SYSTEMTIME st;
             WCHAR buf[128];
 
             substr_skip(&data, len);
 
-            if(end_ptr - data.str < sizeof(buf)/sizeof(WCHAR)-1) {
+            if(end_ptr - data.str < ARRAY_SIZE(buf)-1) {
                 memcpy(buf, data.str, data.len*sizeof(WCHAR));
                 buf[data.len] = 0;
 
@@ -983,10 +986,10 @@ DWORD set_cookie(substr_t domain, substr_t path, substr_t name, substr_t data, D
                     }
                 }
             }
-        }else if(data.len >= (len = sizeof(szSecure)/sizeof(WCHAR)) && !strncmpiW(data.str, szSecure, len)) {
+        }else if(data.len >= (len = ARRAY_SIZE(szSecure)) && !strncmpiW(data.str, szSecure, len)) {
             substr_skip(&data, len);
             FIXME("secure not handled\n");
-        }else if(data.len >= (len = sizeof(szHttpOnly)/sizeof(WCHAR)) && !strncmpiW(data.str, szHttpOnly, len)) {
+        }else if(data.len >= (len = ARRAY_SIZE(szHttpOnly)) && !strncmpiW(data.str, szHttpOnly, len)) {
             substr_skip(&data, len);
 
             if(!(flags & INTERNET_COOKIE_HTTPONLY)) {
@@ -996,11 +999,11 @@ DWORD set_cookie(substr_t domain, substr_t path, substr_t name, substr_t data, D
             }
 
             cookie_flags |= INTERNET_COOKIE_HTTPONLY;
-        }else if(data.len >= (len = sizeof(szVersion)/sizeof(WCHAR)) && !strncmpiW(data.str, szVersion, len)) {
+        }else if(data.len >= (len = ARRAY_SIZE(szVersion)) && !strncmpiW(data.str, szVersion, len)) {
             substr_skip(&data, len);
 
             FIXME("version not handled (%s)\n",debugstr_wn(data.str, data.len));
-        }else if(data.len >= (len = sizeof(max_ageW)/sizeof(WCHAR)) && !strncmpiW(data.str, max_ageW, len)) {
+        }else if(data.len >= (len = ARRAY_SIZE(max_ageW)) && !strncmpiW(data.str, max_ageW, len)) {
             /* Native doesn't support Max-Age attribute. */
             WARN("Max-Age ignored\n");
         }else if(data.len) {
diff --git a/dll/win32/wininet/dialogs.c b/dll/win32/wininet/dialogs.c
index b13b566a8eb..5e26c8b7b4d 100644
--- a/dll/win32/wininet/dialogs.c
+++ b/dll/win32/wininet/dialogs.c
@@ -135,12 +135,10 @@ static BOOL WININET_GetSetPassword( HWND hdlg, LPCWSTR szServer,
     if( bSet )
     {
         szUserPass[0] = 0;
-        GetWindowTextW( hUserItem, szUserPass, 
-                        (sizeof szUserPass-1)/sizeof(WCHAR) );
+        GetWindowTextW( hUserItem, szUserPass, ARRAY_SIZE( szUserPass ) - 1 );
         lstrcatW(szUserPass, szColon);
         u_len = strlenW( szUserPass );
-        GetWindowTextW( hPassItem, szUserPass+u_len, 
-                        (sizeof szUserPass)/sizeof(WCHAR)-u_len );
+        GetWindowTextW( hPassItem, szUserPass+u_len, ARRAY_SIZE( szUserPass ) - u_len );
 
         r_len = (strlenW( szResource ) + 1)*sizeof(WCHAR);
         u_len = (strlenW( szUserPass ) + 1)*sizeof(WCHAR);
@@ -218,7 +216,7 @@ static INT_PTR WINAPI WININET_ProxyPasswordDialog(
 {
     HWND hitem;
     struct WININET_ErrorDlgParams *params;
-    WCHAR szRealm[0x80], szServer[0x80];
+    WCHAR szRealm[0x80];
 
     if( uMsg == WM_INITDIALOG )
     {
@@ -230,7 +228,7 @@ static INT_PTR WINAPI WININET_ProxyPasswordDialog(
 
         /* extract the Realm from the proxy response and show it */
         if( WININET_GetAuthRealm( params->req->hdr.hInternet,
-                                  szRealm, sizeof szRealm/sizeof(WCHAR), TRUE ) )
+                                  szRealm, ARRAY_SIZE( szRealm ), TRUE ) )
         {
             hitem = GetDlgItem( hdlg, IDC_REALM );
             SetWindowTextW( hitem, szRealm );
@@ -239,7 +237,7 @@ static INT_PTR WINAPI WININET_ProxyPasswordDialog(
         hitem = GetDlgItem( hdlg, IDC_PROXY );
         SetWindowTextW( hitem, params->req->session->appInfo->proxy );
 
-        WININET_GetSetPassword( hdlg, szServer, szRealm, FALSE );
+        WININET_GetSetPassword( hdlg, params->req->session->appInfo->proxy, szRealm, FALSE );
 
         return TRUE;
     }
@@ -257,18 +255,18 @@ static INT_PTR WINAPI WININET_ProxyPasswordDialog(
             username[0] = 0;
             hitem = GetDlgItem( hdlg, IDC_USERNAME );
             if( hitem )
-                GetWindowTextW( hitem, username, sizeof username/sizeof(WCHAR) );
-            
+                GetWindowTextW( hitem, username, ARRAY_SIZE( username ));
+
             password[0] = 0;
             hitem = GetDlgItem( hdlg, IDC_PASSWORD );
             if( hitem )
-                GetWindowTextW( hitem, password, sizeof password/sizeof(WCHAR) );
+                GetWindowTextW( hitem, password, ARRAY_SIZE( password ));
 
             hitem = GetDlgItem( hdlg, IDC_SAVEPASSWORD );
             if( hitem &&
                 SendMessageW( hitem, BM_GETSTATE, 0, 0 ) &&
                 WININET_GetAuthRealm( params->req->hdr.hInternet,
-                                      szRealm, sizeof szRealm/sizeof(WCHAR), TRUE) )
+                                      szRealm, ARRAY_SIZE( szRealm ), TRUE) )
                 WININET_GetSetPassword( hdlg, params->req->session->appInfo->proxy, szRealm, TRUE );
             WININET_SetAuthorization( params->req, username, password, TRUE );
 
@@ -293,7 +291,7 @@ static INT_PTR WINAPI WININET_PasswordDialog(
 {
     HWND hitem;
     struct WININET_ErrorDlgParams *params;
-    WCHAR szRealm[0x80], szServer[0x80];
+    WCHAR szRealm[0x80];
 
     if( uMsg == WM_INITDIALOG )
     {
@@ -305,7 +303,7 @@ static INT_PTR WINAPI WININET_PasswordDialog(
 
         /* extract the Realm from the response and show it */
         if( WININET_GetAuthRealm( params->req->hdr.hInternet,
-                                  szRealm, sizeof szRealm/sizeof(WCHAR), FALSE ) )
+                                  szRealm, ARRAY_SIZE( szRealm ), FALSE ) )
         {
             hitem = GetDlgItem( hdlg, IDC_REALM );
             SetWindowTextW( hitem, szRealm );
@@ -314,7 +312,7 @@ static INT_PTR WINAPI WININET_PasswordDialog(
         hitem = GetDlgItem( hdlg, IDC_SERVER );
         SetWindowTextW( hitem, params->req->session->hostName );
 
-        WININET_GetSetPassword( hdlg, szServer, szRealm, FALSE );
+        WININET_GetSetPassword( hdlg, params->req->session->hostName, szRealm, FALSE );
 
         return TRUE;
     }
@@ -332,18 +330,18 @@ static INT_PTR WINAPI WININET_PasswordDialog(
             username[0] = 0;
             hitem = GetDlgItem( hdlg, IDC_USERNAME );
             if( hitem )
-                GetWindowTextW( hitem, username, sizeof username/sizeof(WCHAR) );
+                GetWindowTextW( hitem, username, ARRAY_SIZE( username ));
 
             password[0] = 0;
             hitem = GetDlgItem( hdlg, IDC_PASSWORD );
             if( hitem )
-                GetWindowTextW( hitem, password, sizeof password/sizeof(WCHAR) );
+                GetWindowTextW( hitem, password, ARRAY_SIZE( password ));
 
             hitem = GetDlgItem( hdlg, IDC_SAVEPASSWORD );
             if( hitem &&
                 SendMessageW( hitem, BM_GETSTATE, 0, 0 ) &&
                 WININET_GetAuthRealm( params->req->hdr.hInternet,
-                                      szRealm, sizeof szRealm/sizeof(WCHAR), FALSE ))
+                                      szRealm, ARRAY_SIZE( szRealm ), FALSE ))
             {
                 WININET_GetSetPassword( hdlg, params->req->session->hostName, szRealm, TRUE );
             }
diff --git a/dll/win32/wininet/ftp.c b/dll/win32/wininet/ftp.c
index e12e4941605..f2a88b741ea 100644
--- a/dll/win32/wininet/ftp.c
+++ b/dll/win32/wininet/ftp.c
@@ -2581,8 +2581,7 @@ HINTERNET FTP_Connect(appinfo_t *hIC, LPCWSTR lpszServerName,
 lerror:
     if (!bSuccess)
     {
-        if(lpwfs)
-            WININET_Release( &lpwfs->hdr );
+        WININET_Release(&lpwfs->hdr);
         return NULL;
     }
 
@@ -3746,7 +3745,7 @@ static BOOL FTP_ParseNextFile(INT nSocket, LPCWSTR lpszSearchFile, LPFILEPROPERT
 
             pszToken = strtok(NULL, szSpace);
             if(!pszToken) continue;
-            if(!strcasecmp(pszToken, "<DIR>")) {
+            if(!_strnicmp(pszToken, "<DIR>", -1)) {
                 lpfp->bIsDirectory = TRUE;
                 lpfp->nSize = 0;
                 TRACE("Is directory\n");
diff --git a/dll/win32/wininet/http.c b/dll/win32/wininet/http.c
index 35ea56ba9a5..45036f2fe56 100644
--- a/dll/win32/wininet/http.c
+++ b/dll/win32/wininet/http.c
@@ -42,6 +42,8 @@
 #include <stdio.h>
 #include <time.h>
 #include <assert.h>
+#include <errno.h>
+#include <limits.h>
 
 #include "windef.h"
 #include "winbase.h"
@@ -50,7 +52,6 @@
 #include "winternl.h"
 #define NO_SHLWAPI_STREAM
 #define NO_SHLWAPI_REG
-#define NO_SHLWAPI_STRFCNS
 #define NO_SHLWAPI_GDI
 #include "shlwapi.h"
 #include "sspi.h"
@@ -137,7 +138,6 @@ static const WCHAR emptyW[] = {0};
 
 #define HTTP_ADDHDR_FLAG_ADD				0x20000000
 #define HTTP_ADDHDR_FLAG_ADD_IF_NEW			0x10000000
-#define HTTP_ADDHDR_FLAG_COALESCE			0x40000000
 #define HTTP_ADDHDR_FLAG_COALESCE_WITH_COMMA		0x40000000
 #define HTTP_ADDHDR_FLAG_COALESCE_WITH_SEMICOLON	0x01000000
 #define HTTP_ADDHDR_FLAG_REPLACE			0x80000000
@@ -145,9 +145,6 @@ static const WCHAR emptyW[] = {0};
 
 #define COLLECT_TIME 60000
 
-#undef ARRAYSIZE
-#define ARRAYSIZE(array) (sizeof(array)/sizeof((array)[0]))
-
 struct HttpAuthInfo
 {
     LPWSTR scheme;
@@ -830,12 +827,12 @@ static inline BOOL is_basic_auth_value( LPCWSTR pszAuthValue, LPWSTR *pszRealm )
     static const WCHAR szBasic[] = {'B','a','s','i','c'}; /* Note: not nul-terminated */
     static const WCHAR szRealm[] = {'r','e','a','l','m'}; /* Note: not nul-terminated */
     BOOL is_basic;
-    is_basic = !strncmpiW(pszAuthValue, szBasic, ARRAYSIZE(szBasic)) &&
-        ((pszAuthValue[ARRAYSIZE(szBasic)] == ' ') || !pszAuthValue[ARRAYSIZE(szBasic)]);
+    is_basic = !strncmpiW(pszAuthValue, szBasic, ARRAY_SIZE(szBasic)) &&
+        ((pszAuthValue[ARRAY_SIZE(szBasic)] == ' ') || !pszAuthValue[ARRAY_SIZE(szBasic)]);
     if (is_basic && pszRealm)
     {
         LPCWSTR token;
-        LPCWSTR ptr = &pszAuthValue[ARRAYSIZE(szBasic)];
+        LPCWSTR ptr = &pszAuthValue[ARRAY_SIZE(szBasic)];
         LPCWSTR realm;
         ptr++;
         *pszRealm=NULL;
@@ -845,8 +842,8 @@ static inline BOOL is_basic_auth_value( LPCWSTR pszAuthValue, LPWSTR *pszRealm )
         realm = ptr;
         while (*realm == ' ')
             realm++;
-        if(!strncmpiW(realm, szRealm, ARRAYSIZE(szRealm)) &&
-            (realm[ARRAYSIZE(szRealm)] == ' ' || realm[ARRAYSIZE(szRealm)] == '='))
+        if(!strncmpiW(realm, szRealm, ARRAY_SIZE(szRealm)) &&
+            (realm[ARRAY_SIZE(szRealm)] == ' ' || realm[ARRAY_SIZE(szRealm)] == '='))
         {
             token++;
             while (*token == ' ')
@@ -875,7 +872,7 @@ static void destroy_authinfo( struct HttpAuthInfo *authinfo )
     heap_free(authinfo);
 }
 
-static UINT retrieve_cached_basic_authorization(const WCHAR *host, const WCHAR *realm, char **auth_data)
+static UINT retrieve_cached_basic_authorization(http_request_t *req, const WCHAR *host, const WCHAR *realm, char **auth_data)
 {
     basicAuthorizationData *ad;
     UINT rc = 0;
@@ -887,10 +884,24 @@ static UINT retrieve_cached_basic_authorization(const WCHAR *host, const WCHAR *
     {
         if (!strcmpiW(host, ad->host) && (!realm || !strcmpW(realm, ad->realm)))
         {
+            char *colon;
+            DWORD length;
+
             TRACE("Authorization found in cache\n");
             *auth_data = heap_alloc(ad->authorizationLen);
             memcpy(*auth_data,ad->authorization,ad->authorizationLen);
             rc = ad->authorizationLen;
+
+            /* update session username and password to reflect current credentials */
+            colon = strchr(ad->authorization, ':');
+            length = colon - ad->authorization;
+
+            heap_free(req->session->userName);
+            heap_free(req->session->password);
+
+            req->session->userName = heap_strndupAtoW(ad->authorization, length, &length);
+            length++;
+            req->session->password = heap_strndupAtoW(&ad->authorization[length], ad->authorizationLen - length, &length);
             break;
         }
     }
@@ -1027,6 +1038,37 @@ static void cache_authorization(LPWSTR host, LPWSTR scheme,
     LeaveCriticalSection(&authcache_cs);
 }
 
+void free_authorization_cache(void)
+{
+    authorizationData *ad, *sa_safe;
+    basicAuthorizationData *basic, *basic_safe;
+
+    EnterCriticalSection(&authcache_cs);
+
+    LIST_FOR_EACH_ENTRY_SAFE(basic, basic_safe, &basicAuthorizationCache, basicAuthorizationData, entry)
+    {
+        heap_free(basic->host);
+        heap_free(basic->realm);
+        heap_free(basic->authorization);
+
+        list_remove(&basic->entry);
+        heap_free(basic);
+    }
+
+    LIST_FOR_EACH_ENTRY_SAFE(ad, sa_safe, &authorizationCache, authorizationData, entry)
+    {
+        heap_free(ad->host);
+        heap_free(ad->scheme);
+        heap_free(ad->user);
+        heap_free(ad->password);
+        heap_free(ad->domain);
+        list_remove(&ad->entry);
+        heap_free(ad);
+    }
+
+    LeaveCriticalSection(&authcache_cs);
+}
+
 static BOOL HTTP_DoAuthorization( http_request_t *request, LPCWSTR pszAuthValue,
                                   struct HttpAuthInfo **ppAuthInfo,
                                   LPWSTR domain_and_username, LPWSTR password,
@@ -1166,7 +1208,7 @@ static BOOL HTTP_DoAuthorization( http_request_t *request, LPCWSTR pszAuthValue,
         if (!domain_and_username)
         {
             if (host && szRealm)
-                auth_data_len = retrieve_cached_basic_authorization(host, szRealm,&auth_data);
+                auth_data_len = retrieve_cached_basic_authorization(request, host, szRealm,&auth_data);
             if (auth_data_len == 0)
             {
                 heap_free(szRealm);
@@ -1357,7 +1399,7 @@ BOOL WINAPI HttpAddRequestHeadersW(HINTERNET hHttpRequest,
     http_request_t *request;
     DWORD res = ERROR_INTERNET_INCORRECT_HANDLE_TYPE;
 
-    TRACE("%p, %s, %i, %i\n", hHttpRequest, debugstr_wn(lpszHeader, dwHeaderLength), dwHeaderLength, dwModifier);
+    TRACE("%p, %s, %u, %08x\n", hHttpRequest, debugstr_wn(lpszHeader, dwHeaderLength), dwHeaderLength, dwModifier);
 
     if (!lpszHeader) 
       return TRUE;
@@ -1389,7 +1431,7 @@ BOOL WINAPI HttpAddRequestHeadersA(HINTERNET hHttpRequest,
     WCHAR *headers = NULL;
     BOOL r;
 
-    TRACE("%p, %s, %i, %i\n", hHttpRequest, debugstr_an(lpszHeader, dwHeaderLength), dwHeaderLength, dwModifier);
+    TRACE("%p, %s, %u, %08x\n", hHttpRequest, debugstr_an(lpszHeader, dwHeaderLength), dwHeaderLength, dwModifier);
 
     if(lpszHeader)
         headers = heap_strndupAtoW(lpszHeader, dwHeaderLength, &dwHeaderLength);
@@ -1586,9 +1628,9 @@ static UINT HTTP_DecodeBase64( LPCWSTR base64, LPSTR bin )
     {
         signed char in[4];
 
-        if (base64[0] >= ARRAYSIZE(HTTP_Base64Dec) ||
+        if (base64[0] >= ARRAY_SIZE(HTTP_Base64Dec) ||
             ((in[0] = HTTP_Base64Dec[base64[0]]) == -1) ||
-            base64[1] >= ARRAYSIZE(HTTP_Base64Dec) ||
+            base64[1] >= ARRAY_SIZE(HTTP_Base64Dec) ||
             ((in[1] = HTTP_Base64Dec[base64[1]]) == -1))
         {
             WARN("invalid base64: %s\n", debugstr_w(base64));
@@ -1600,7 +1642,7 @@ static UINT HTTP_DecodeBase64( LPCWSTR base64, LPSTR bin )
 
         if ((base64[2] == '=') && (base64[3] == '='))
             break;
-        if (base64[2] > ARRAYSIZE(HTTP_Base64Dec) ||
+        if (base64[2] > ARRAY_SIZE(HTTP_Base64Dec) ||
             ((in[2] = HTTP_Base64Dec[base64[2]]) == -1))
         {
             WARN("invalid base64: %s\n", debugstr_w(&base64[2]));
@@ -1612,7 +1654,7 @@ static UINT HTTP_DecodeBase64( LPCWSTR base64, LPSTR bin )
 
         if (base64[3] == '=')
             break;
-        if (base64[3] > ARRAYSIZE(HTTP_Base64Dec) ||
+        if (base64[3] > ARRAY_SIZE(HTTP_Base64Dec) ||
             ((in[3] = HTTP_Base64Dec[base64[3]]) == -1))
         {
             WARN("invalid base64: %s\n", debugstr_w(&base64[3]));
@@ -1677,12 +1719,19 @@ static BOOL HTTP_InsertAuthorization( http_request_t *request, struct HttpAuthIn
                            HTTP_ADDHDR_FLAG_REQ | HTTP_ADDHDR_FLAG_REPLACE | HTTP_ADDREQ_FLAG_ADD);
         heap_free(authorization);
     }
-    else if (!strcmpW(header, szAuthorization) && (host = get_host_header(request)))
+    else
     {
         UINT data_len;
         char *data;
 
-        if ((data_len = retrieve_cached_basic_authorization(host, NULL, &data)))
+        /* Don't use cached credentials when a username or Authorization was specified */
+        if ((request->session->userName && request->session->userName[0]) || strcmpW(header, szAuthorization))
+            return TRUE;
+
+        if (!(host = get_host_header(request)))
+            return TRUE;
+
+        if ((data_len = retrieve_cached_basic_authorization(request, host, NULL, &data)))
         {
             TRACE("Found cached basic authorization for %s\n", debugstr_w(host));
 
@@ -1734,7 +1783,7 @@ static BOOL HTTP_DomainMatches(LPCWSTR server, substr_t domain)
     const WCHAR *dot, *ptr;
     int len;
 
-    if(domain.len == sizeof(localW)/sizeof(WCHAR)-1 && !strncmpiW(domain.str, localW, domain.len) && !strchrW(server, '.' ))
+    if(domain.len == ARRAY_SIZE(localW)-1 && !strncmpiW(domain.str, localW, domain.len) && !strchrW(server, '.' ))
         return TRUE;
 
     if(domain.len && *domain.str != '*')
@@ -2294,6 +2343,15 @@ static DWORD HTTPREQ_QueryOption(object_header_t *hdr, DWORD option, void *buffe
         *(DWORD*)buffer = flags;
         return ERROR_SUCCESS;
     }
+    case INTERNET_OPTION_ERROR_MASK:
+        TRACE("INTERNET_OPTION_ERROR_MASK\n");
+
+        if (*size < sizeof(ULONG))
+            return ERROR_INSUFFICIENT_BUFFER;
+
+        *(ULONG*)buffer = hdr->ErrorMask;
+        *size = sizeof(ULONG);
+        return ERROR_SUCCESS;
     }
 
     return INET_QueryOption(hdr, option, buffer, size, unicode);
@@ -2431,8 +2489,8 @@ static void create_cache_entry(http_request_t *req)
                 if(!end)
                     end = ptr + strlenW(ptr);
 
-                if(!strncmpiW(ptr, no_cacheW, sizeof(no_cacheW)/sizeof(*no_cacheW)-1)
-                        || !strncmpiW(ptr, no_storeW, sizeof(no_storeW)/sizeof(*no_storeW)-1)) {
+                if(!strncmpiW(ptr, no_cacheW, ARRAY_SIZE(no_cacheW)-1)
+                        || !strncmpiW(ptr, no_storeW, ARRAY_SIZE(no_storeW)-1)) {
                     b = FALSE;
                     break;
                 }
@@ -2459,7 +2517,7 @@ static void create_cache_entry(http_request_t *req)
         return;
     }
 
-    b = CreateUrlCacheEntryW(url, req->contentLength == ~0u ? 0 : req->contentLength, NULL, file_name, 0);
+    b = CreateUrlCacheEntryW(url, req->contentLength == ~0 ? 0 : req->contentLength, NULL, file_name, 0);
     if(!b) {
         WARN("Could not create cache entry: %08x\n", GetLastError());
         return;
@@ -2663,7 +2721,7 @@ static DWORD netconn_drain_content(data_stream_t *stream, http_request_t *req, B
     int len, res;
     size_t size;
 
-    if(netconn_stream->content_length == ~0u)
+    if(netconn_stream->content_length == ~0)
         return WSAEISCONN;
 
     while(netconn_stream->content_read < netconn_stream->content_length) {
@@ -2769,7 +2827,7 @@ static DWORD chunked_read(data_stream_t *stream, http_request_t *req, BYTE *buf,
                 TRACE("reading %u byte chunk\n", chunked_stream->chunk_size);
                 chunked_stream->buf_size++;
                 chunked_stream->buf_pos--;
-                if(req->contentLength == ~0u) req->contentLength = chunked_stream->chunk_size;
+                if(req->contentLength == ~0) req->contentLength = chunked_stream->chunk_size;
                 else req->contentLength += chunked_stream->chunk_size;
                 chunked_stream->state = CHUNKED_STREAM_STATE_DISCARD_EOL_AFTER_SIZE;
             }
@@ -2891,6 +2949,7 @@ static DWORD set_content_length(http_request_t *request)
 {
     static const WCHAR szChunked[] = {'c','h','u','n','k','e','d',0};
     static const WCHAR headW[] = {'H','E','A','D',0};
+    WCHAR contentLength[32];
     WCHAR encoding[20];
     DWORD size;
 
@@ -2899,10 +2958,13 @@ static DWORD set_content_length(http_request_t *request)
         return ERROR_SUCCESS;
     }
 
-    size = sizeof(request->contentLength);
-    if (HTTP_HttpQueryInfoW(request, HTTP_QUERY_FLAG_NUMBER|HTTP_QUERY_CONTENT_LENGTH,
-                            &request->contentLength, &size, NULL) != ERROR_SUCCESS)
-        request->contentLength = ~0u;
+    size = sizeof(contentLength);
+    if (HTTP_HttpQueryInfoW(request, HTTP_QUERY_CONTENT_LENGTH,
+                            contentLength, &size, NULL) != ERROR_SUCCESS ||
+        !StrToInt64ExW(contentLength, STIF_DEFAULT, (LONGLONG*)&request->contentLength)) {
+        request->contentLength = ~0;
+    }
+
     request->netconn_stream.content_length = request->contentLength;
     request->netconn_stream.content_read = request->read_size;
 
@@ -2928,7 +2990,7 @@ static DWORD set_content_length(http_request_t *request)
         }
 
         request->data_stream = &chunked_stream->data_stream;
-        request->contentLength = ~0u;
+        request->contentLength = ~0;
     }
 
     if(request->hdr.decoding) {
@@ -3318,7 +3380,7 @@ static DWORD HTTP_HttpOpenRequestW(http_session_t *session,
     request->hdr.dwFlags = dwFlags;
     request->hdr.dwContext = dwContext;
     request->hdr.decoding = session->hdr.decoding;
-    request->contentLength = ~0u;
+    request->contentLength = ~0;
 
     request->netconn_stream.data_stream.vtbl = &netconn_stream_vtbl;
     request->data_stream = &request->netconn_stream.data_stream;
@@ -3536,8 +3598,6 @@ static const LPCWSTR header_lookup[] = {
     szUnless_Modified_Since,	/* HTTP_QUERY_UNLESS_MODIFIED_SINCE = 70 */
 };
 
-#define LAST_TABLE_HEADER (sizeof(header_lookup)/sizeof(header_lookup[0]))
-
 /***********************************************************************
  *           HTTP_HttpQueryInfoW (internal)
  */
@@ -3723,9 +3783,9 @@ static DWORD HTTP_HttpQueryInfoW(http_request_t *request, DWORD dwInfoLevel,
         return res;
     }
     default:
-        assert (LAST_TABLE_HEADER == (HTTP_QUERY_UNLESS_MODIFIED_SINCE + 1));
+        assert (ARRAY_SIZE(header_lookup) == (HTTP_QUERY_UNLESS_MODIFIED_SINCE + 1));
 
-        if (level < LAST_TABLE_HEADER && header_lookup[level])
+        if (level < ARRAY_SIZE(header_lookup) && header_lookup[level])
             index = HTTP_GetCustomHeaderIndex(request, header_lookup[level],
                                               requested_index,request_only);
     }
@@ -3745,9 +3805,25 @@ static DWORD HTTP_HttpQueryInfoW(http_request_t *request, DWORD dwInfoLevel,
     /* coalesce value to requested type */
     if (dwInfoLevel & HTTP_QUERY_FLAG_NUMBER && lpBuffer)
     {
-        *(int *)lpBuffer = atoiW(lphttpHdr->lpszValue);
-        TRACE(" returning number: %d\n", *(int *)lpBuffer);
-     }
+        unsigned long value;
+
+        if (*lpdwBufferLength != sizeof(DWORD))
+        {
+            LeaveCriticalSection( &request->headers_section );
+            return ERROR_HTTP_INVALID_HEADER;
+        }
+
+        errno = 0;
+        value = strtoulW( lphttpHdr->lpszValue, NULL, 10 );
+        if (value > UINT_MAX || (value == ULONG_MAX && errno == ERANGE))
+        {
+            LeaveCriticalSection( &request->headers_section );
+            return ERROR_HTTP_INVALID_HEADER;
+        }
+
+        *(DWORD *)lpBuffer = value;
+        TRACE(" returning number: %u\n", *(DWORD *)lpBuffer);
+    }
     else if (dwInfoLevel & HTTP_QUERY_FLAG_SYSTEMTIME && lpBuffer)
     {
         time_t tmpTime;
@@ -3896,18 +3972,18 @@ BOOL WINAPI HttpQueryInfoW(HINTERNET hHttpRequest, DWORD dwInfoLevel,
 
 	TRACE("(%p, 0x%08x)--> %d\n", hHttpRequest, dwInfoLevel, info);
 	TRACE("  Attribute:");
-	for (i = 0; i < (sizeof(query_flags) / sizeof(query_flags[0])); i++) {
+        for (i = 0; i < ARRAY_SIZE(query_flags); i++) {
 	    if (query_flags[i].val == info) {
 		TRACE(" %s", query_flags[i].name);
 		break;
 	    }
 	}
-	if (i == (sizeof(query_flags) / sizeof(query_flags[0]))) {
+        if (i == ARRAY_SIZE(query_flags)) {
 	    TRACE(" Unknown (%08x)", info);
 	}
 
 	TRACE(" Modifier:");
-	for (i = 0; i < (sizeof(modifier_flags) / sizeof(modifier_flags[0])); i++) {
+        for (i = 0; i < ARRAY_SIZE(modifier_flags); i++) {
 	    if (modifier_flags[i].val & info_mod) {
 		TRACE(" %s", modifier_flags[i].name);
 		info_mod &= ~ modifier_flags[i].val;
@@ -3937,8 +4013,8 @@ lend:
          WININET_Release( &request->hdr );
 
     TRACE("%u <--\n", res);
-    if(res != ERROR_SUCCESS)
-        SetLastError(res);
+
+    SetLastError(res);
     return res == ERROR_SUCCESS;
 }
 
@@ -4233,7 +4309,7 @@ static WORD HTTP_ParseWkday(LPCWSTR day)
                                      { 'f','r','i',0 },
                                      { 's','a','t',0 }};
     unsigned int i;
-    for (i = 0; i < sizeof(days)/sizeof(*days); i++)
+    for (i = 0; i < ARRAY_SIZE(days); i++)
         if (!strcmpiW(day, days[i]))
             return i;
 
@@ -4323,8 +4399,7 @@ static BOOL HTTP_ParseTime(SYSTEMTIME *st, LPCWSTR *str)
         ERR("unexpected second in time format %s\n", debugstr_w(ptr));
         return FALSE;
     }
-    ptr = nextPtr + 1;
-    *str = ptr;
+    *str = nextPtr;
     st->wSecond = (WORD)num;
     return TRUE;
 }
@@ -4338,7 +4413,7 @@ static BOOL HTTP_ParseDateAsAsctime(LPCWSTR value, FILETIME *ft)
     unsigned long num;
 
     for (ptr = value, dayPtr = day; *ptr && !isspaceW(*ptr) &&
-         dayPtr - day < sizeof(day) / sizeof(day[0]) - 1; ptr++, dayPtr++)
+         dayPtr - day < ARRAY_SIZE(day) - 1; ptr++, dayPtr++)
         *dayPtr = *ptr;
     *dayPtr = 0;
     st.wDayOfWeek = HTTP_ParseWkday(day);
@@ -4351,8 +4426,7 @@ static BOOL HTTP_ParseDateAsAsctime(LPCWSTR value, FILETIME *ft)
     while (isspaceW(*ptr))
         ptr++;
 
-    for (monthPtr = month; !isspaceW(*ptr) &&
-         monthPtr - month < sizeof(month) / sizeof(month[0]) - 1;
+    for (monthPtr = month; !isspaceW(*ptr) && monthPtr - month < ARRAY_SIZE(month) - 1;
          monthPtr++, ptr++)
         *monthPtr = *ptr;
     *monthPtr = 0;
@@ -4448,8 +4522,7 @@ static BOOL HTTP_ParseRfc1123Date(LPCWSTR value, FILETIME *ft)
     while (isspaceW(*ptr))
         ptr++;
 
-    for (monthPtr = month; !isspaceW(*ptr) &&
-         monthPtr - month < sizeof(month) / sizeof(month[0]) - 1;
+    for (monthPtr = month; !isspaceW(*ptr) && monthPtr - month < ARRAY_SIZE(month) - 1;
          monthPtr++, ptr++)
         *monthPtr = *ptr;
     *monthPtr = 0;
@@ -4496,7 +4569,7 @@ static WORD HTTP_ParseWeekday(LPCWSTR day)
                                      { 'f','r','i','d','a','y',0 },
                                      { 's','a','t','u','r','d','a','y',0 }};
     unsigned int i;
-    for (i = 0; i < sizeof(days)/sizeof(*days); i++)
+    for (i = 0; i < ARRAY_SIZE(days); i++)
         if (!strcmpiW(day, days[i]))
             return i;
 
@@ -4526,7 +4599,7 @@ static BOOL HTTP_ParseRfc850Date(LPCWSTR value, FILETIME *ft)
             return FALSE;
         }
     }
-    else if (ptr - value < sizeof(day) / sizeof(day[0]))
+    else if (ptr - value < ARRAY_SIZE(day))
     {
         memcpy(day, value, (ptr - value) * sizeof(WCHAR));
         day[ptr - value + 1] = 0;
@@ -4563,8 +4636,7 @@ static BOOL HTTP_ParseRfc850Date(LPCWSTR value, FILETIME *ft)
     }
     ptr++;
 
-    for (monthPtr = month; *ptr != '-' &&
-         monthPtr - month < sizeof(month) / sizeof(month[0]) - 1;
+    for (monthPtr = month; *ptr != '-' && monthPtr - month < ARRAY_SIZE(month) - 1;
          monthPtr++, ptr++)
         *monthPtr = *ptr;
     *monthPtr = 0;
@@ -4762,7 +4834,6 @@ static void http_process_keep_alive(http_request_t *req)
 
 static DWORD open_http_connection(http_request_t *request, BOOL *reusing)
 {
-    const BOOL is_https = (request->hdr.dwFlags & INTERNET_FLAG_SECURE) != 0;
     netconn_t *netconn = NULL;
     DWORD res;
 
@@ -4817,7 +4888,7 @@ static DWORD open_http_connection(http_request_t *request, BOOL *reusing)
                           request->server->addr_str,
                           strlen(request->server->addr_str)+1);
 
-    res = create_netconn(is_https, request->proxy ? request->proxy : request->server, request->security_flags,
+    res = create_netconn(request->proxy ? request->proxy : request->server, request->security_flags,
                          (request->hdr.ErrorMask & INTERNET_ERROR_MASK_COMBINED_SEC_CERT) != 0,
                          request->connect_timeout, &netconn);
     if(res != ERROR_SUCCESS) {
@@ -4853,7 +4924,7 @@ static void set_content_length_header( http_request_t *request, DWORD len, DWORD
 {
     static const WCHAR fmtW[] =
         {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',':',' ','%','u','\r','\n',0};
-    WCHAR buf[sizeof(fmtW)/sizeof(fmtW[0]) + 10];
+    WCHAR buf[ARRAY_SIZE(fmtW) + 10];
 
     sprintfW( buf, fmtW, len );
     HTTP_HttpAddRequestHeadersW( request, buf, ~0u, flags );
@@ -4874,7 +4945,7 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
 	DWORD dwContentLength, BOOL bEndRequest)
 {
     BOOL redirected = FALSE, secure_proxy_connect = FALSE, loop_next;
-    LPWSTR requestString = NULL;
+    WCHAR *request_header = NULL;
     INT responseLen, cnt;
     DWORD res;
 
@@ -4932,7 +5003,7 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
         loop_next = FALSE;
 
         if(redirected) {
-            request->contentLength = ~0u;
+            request->contentLength = ~0;
             request->bytesToWrite = 0;
         }
 
@@ -4984,12 +5055,12 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
             if (HTTP_GetCustomHeaderIndex(request, szContent_Length, 0, TRUE) >= 0)
                 set_content_length_header(request, 0, HTTP_ADDREQ_FLAG_REPLACE);
 
-            requestString = build_request_header(request, connectW, target, g_szHttp1_1, TRUE);
+            request_header = build_request_header(request, connectW, target, g_szHttp1_1, TRUE);
         }
         else if (request->proxy && !(request->hdr.dwFlags & INTERNET_FLAG_SECURE))
         {
             WCHAR *url = build_proxy_path_url(request);
-            requestString = build_request_header(request, request->verb, url, request->version, TRUE);
+            request_header = build_request_header(request, request->verb, url, request->version, TRUE);
             heap_free(url);
         }
         else
@@ -4997,16 +5068,17 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
             if (request->proxy && HTTP_GetCustomHeaderIndex(request, szContent_Length, 0, TRUE) >= 0)
                 set_content_length_header(request, dwContentLength, HTTP_ADDREQ_FLAG_REPLACE);
 
-            requestString = build_request_header(request, request->verb, request->path, request->version, TRUE);
+            request_header = build_request_header(request, request->verb, request->path, request->version, TRUE);
         }
 
-        TRACE("Request header -> %s\n", debugstr_w(requestString) );
+        TRACE("Request header -> %s\n", debugstr_w(request_header) );
 
         /* send the request as ASCII, tack on the optional data */
         if (!lpOptional || redirected || secure_proxy_connect)
             data_len = 0;
 
-        ascii_req = build_ascii_request( requestString, lpOptional, data_len, &len );
+        ascii_req = build_ascii_request(request_header, lpOptional, data_len, &len);
+        heap_free(request_header);
         TRACE("full request -> %s\n", debugstr_a(ascii_req) );
 
         INTERNET_SendCallback(&request->hdr, request->hdr.dwContext,
@@ -5089,10 +5161,8 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
                     http_release_netconn(request, drain_content(request, FALSE) == ERROR_SUCCESS);
                     res = HTTP_HandleRedirect(request, new_url);
                     heap_free(new_url);
-                    if (res == ERROR_SUCCESS) {
-                        heap_free(requestString);
+                    if (res == ERROR_SUCCESS)
                         loop_next = TRUE;
-                    }
                     redirected = TRUE;
                 }
             }
@@ -5111,7 +5181,6 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
                                                  request->session->userName,
                                                  request->session->password, host))
                         {
-                            heap_free(requestString);
                             if (drain_content(request, TRUE) != ERROR_SUCCESS)
                             {
                                 FIXME("Could not drain content\n");
@@ -5140,7 +5209,6 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
                                                  request->session->appInfo->proxyPassword,
                                                  NULL))
                         {
-                            heap_free(requestString);
                             if (drain_content(request, TRUE) != ERROR_SUCCESS)
                             {
                                 FIXME("Could not drain content\n");
@@ -5183,8 +5251,6 @@ static DWORD HTTP_HttpSendRequestW(http_request_t *request, LPCWSTR lpszHeaders,
     while (loop_next);
 
 lend:
-    heap_free(requestString);
-
     /* TODO: send notification for P3P header */
 
     if(res == ERROR_SUCCESS)
@@ -5838,8 +5904,7 @@ DWORD HTTP_Connect(appinfo_t *hIC, LPCWSTR lpszServerName,
     session->hostName = heap_strdupW(lpszServerName);
     if (lpszUserName && lpszUserName[0])
         session->userName = heap_strdupW(lpszUserName);
-    if (lpszPassword && lpszPassword[0])
-        session->password = heap_strdupW(lpszPassword);
+    session->password = heap_strdupW(lpszPassword);
     session->hostPort = serverPort;
     session->connect_timeout = hIC->connect_timeout;
     session->send_timeout = 0;
@@ -6083,7 +6148,7 @@ static LPWSTR * HTTP_InterpretHttpHeader(LPCWSTR buffer)
  *
  */
 
-#define COALESCEFLAGS (HTTP_ADDHDR_FLAG_COALESCE|HTTP_ADDHDR_FLAG_COALESCE_WITH_COMMA|HTTP_ADDHDR_FLAG_COALESCE_WITH_SEMICOLON)
+#define COALESCEFLAGS (HTTP_ADDHDR_FLAG_COALESCE_WITH_COMMA|HTTP_ADDHDR_FLAG_COALESCE_WITH_SEMICOLON)
 
 static DWORD HTTP_ProcessHeader(http_request_t *request, LPCWSTR field, LPCWSTR value, DWORD dwModifier)
 {
diff --git a/dll/win32/wininet/internet.c b/dll/win32/wininet/internet.c
index 3df84d1d73f..fe45030c8c5 100644
--- a/dll/win32/wininet/internet.c
+++ b/dll/win32/wininet/internet.c
@@ -34,7 +34,6 @@
 #include <CoreServices/CoreServices.h>
 #undef GetCurrentThread
 #undef LoadResource
-#undef DPRINTF
 #endif
 
 #include "winsock2.h"
@@ -777,7 +776,7 @@ static void dump_INTERNET_FLAGS(DWORD dwFlags)
 #undef FE
     unsigned int i;
 
-    for (i = 0; i < (sizeof(flag) / sizeof(flag[0])); i++) {
+    for (i = 0; i < ARRAY_SIZE(flag); i++) {
 	if (flag[i].val & dwFlags) {
 	    TRACE(" %s", flag[i].name);
 	    dwFlags &= ~flag[i].val;
@@ -1021,7 +1020,7 @@ HINTERNET WINAPI InternetOpenW(LPCWSTR lpszAgent, DWORD dwAccessType,
 	
 	TRACE("(%s, %i, %s, %s, %i)\n", debugstr_w(lpszAgent), dwAccessType,
 	      debugstr_w(lpszProxy), debugstr_w(lpszProxyBypass), dwFlags);
-	for (i = 0; i < (sizeof(access_type) / sizeof(access_type[0])); i++) {
+        for (i = 0; i < ARRAY_SIZE(access_type); i++) {
 	    if (access_type[i].val == dwAccessType) {
 		access_type_str = access_type[i].name;
 		break;
@@ -1626,7 +1625,7 @@ static INTERNET_SCHEME GetInternetSchemeW(LPCWSTR lpszScheme, DWORD nMaxCmp)
     if(lpszScheme==NULL)
         return INTERNET_SCHEME_UNKNOWN;
 
-    for (i = 0; i < sizeof(url_schemes)/sizeof(url_schemes[0]); i++)
+    for (i = 0; i < ARRAY_SIZE(url_schemes); i++)
         if (!strncmpiW(lpszScheme, url_schemes[i], nMaxCmp))
             return INTERNET_SCHEME_FIRST + i;
 
@@ -2197,8 +2196,7 @@ BOOL WINAPI InternetReadFile(HINTERNET hFile, LPVOID lpBuffer,
     TRACE("-- %s (%u) (bytes read: %d)\n", res == ERROR_SUCCESS ? "TRUE": "FALSE", res,
           pdwNumOfBytesRead ? *pdwNumOfBytesRead : -1);
 
-    if(res != ERROR_SUCCESS)
-        SetLastError(res);
+    SetLastError(res);
     return res == ERROR_SUCCESS;
 }
 
@@ -2836,6 +2834,7 @@ BOOL WINAPI InternetSetOptionW(HINTERNET hInternet, DWORD dwOption,
     case INTERNET_OPTION_END_BROWSER_SESSION:
         FIXME("Option INTERNET_OPTION_END_BROWSER_SESSION: semi-stub\n");
         free_cookie();
+        free_authorization_cache();
         break;
     case INTERNET_OPTION_CONNECTED_STATE:
         FIXME("Option INTERNET_OPTION_CONNECTED_STATE: STUB\n");
@@ -2880,7 +2879,6 @@ BOOL WINAPI InternetSetOptionW(HINTERNET hInternet, DWORD dwOption,
 	 FIXME("Option INTERNET_OPTION_DISABLE_AUTODIAL; STUB\n");
 	 break;
     case INTERNET_OPTION_HTTP_DECODING:
-    {
         if (!lpwhh)
         {
             SetLastError(ERROR_INTERNET_INCORRECT_HANDLE_TYPE);
@@ -2894,7 +2892,6 @@ BOOL WINAPI InternetSetOptionW(HINTERNET hInternet, DWORD dwOption,
         else
             lpwhh->decoding = *(BOOL *)lpBuffer;
         break;
-    }
     case INTERNET_OPTION_COOKIES_3RD_PARTY:
         FIXME("INTERNET_OPTION_COOKIES_3RD_PARTY; STUB\n");
         SetLastError(ERROR_INTERNET_INVALID_OPTION);
@@ -4091,7 +4088,7 @@ static LPCWSTR INTERNET_GetSchemeString(INTERNET_SCHEME scheme)
     if (scheme < INTERNET_SCHEME_FIRST)
         return NULL;
     index = scheme - INTERNET_SCHEME_FIRST;
-    if (index >= sizeof(url_schemes)/sizeof(url_schemes[0]))
+    if (index >= ARRAY_SIZE(url_schemes))
         return NULL;
     return (LPCWSTR)url_schemes[index];
 }
@@ -4368,7 +4365,7 @@ BOOL WINAPI InternetCreateUrlW(LPURL_COMPONENTSW lpUrlComponents, DWORD dwFlags,
     if (!scheme_is_opaque(nScheme) || lpUrlComponents->lpszHostName)
     {
         memcpy(lpszUrl, slashSlashW, sizeof(slashSlashW));
-        lpszUrl += sizeof(slashSlashW)/sizeof(slashSlashW[0]);
+        lpszUrl += ARRAY_SIZE(slashSlashW);
     }
 
     if (lpUrlComponents->lpszUserName)
diff --git a/dll/win32/wininet/internet.h b/dll/win32/wininet/internet.h
index e80f6036f02..8954d071f9b 100644
--- a/dll/win32/wininet/internet.h
+++ b/dll/win32/wininet/internet.h
@@ -335,8 +335,8 @@ typedef struct {
 
 typedef struct {
     data_stream_t data_stream;
-    DWORD content_length;
-    DWORD content_read;
+    ULONGLONG content_length;
+    ULONGLONG content_read;
 } netconn_stream_t;
 
 #define READ_BUFFER_SIZE 8192
@@ -372,7 +372,7 @@ typedef struct
     struct HttpAuthInfo *proxyAuthInfo;
 
     CRITICAL_SECTION read_section;  /* section to protect the following fields */
-    DWORD contentLength;  /* total number of bytes to be read */
+    ULONGLONG contentLength;  /* total number of bytes to be read */
     BOOL  read_gzip;      /* are we reading in gzip mode? */
     DWORD read_pos;       /* current read position in read_buf */
     DWORD read_size;      /* valid data size in read_buf */
@@ -428,7 +428,7 @@ VOID INTERNET_SendCallback(object_header_t *hdr, DWORD_PTR dwContext,
                            DWORD dwStatusInfoLength) DECLSPEC_HIDDEN;
 WCHAR *INTERNET_FindProxyForProtocol(LPCWSTR szProxy, LPCWSTR proto) DECLSPEC_HIDDEN;
 
-DWORD create_netconn(BOOL,server_t*,DWORD,BOOL,DWORD,netconn_t**) DECLSPEC_HIDDEN;
+DWORD create_netconn(server_t*,DWORD,BOOL,DWORD,netconn_t**) DECLSPEC_HIDDEN;
 void free_netconn(netconn_t*) DECLSPEC_HIDDEN;
 void NETCON_unload(void) DECLSPEC_HIDDEN;
 DWORD NETCON_secure_connect(netconn_t*,server_t*) DECLSPEC_HIDDEN;
@@ -456,6 +456,7 @@ static inline req_file_t *req_file_addref(req_file_t *req_file)
 BOOL init_urlcache(void) DECLSPEC_HIDDEN;
 void free_urlcache(void) DECLSPEC_HIDDEN;
 void free_cookie(void) DECLSPEC_HIDDEN;
+void free_authorization_cache(void) DECLSPEC_HIDDEN;
 
 void init_winsock(void) DECLSPEC_HIDDEN;
 
diff --git a/dll/win32/wininet/netconnection.c b/dll/win32/wininet/netconnection.c
index b91c6be8dc6..d177d98a2a4 100644
--- a/dll/win32/wininet/netconnection.c
+++ b/dll/win32/wininet/netconnection.c
@@ -340,7 +340,7 @@ static DWORD create_netconn_socket(server_t *server, netconn_t *netconn, DWORD t
     return ERROR_SUCCESS;
 }
 
-DWORD create_netconn(BOOL useSSL, server_t *server, DWORD security_flags, BOOL mask_errors, DWORD timeout, netconn_t **ret)
+DWORD create_netconn(server_t *server, DWORD security_flags, BOOL mask_errors, DWORD timeout, netconn_t **ret)
 {
     netconn_t *netconn;
     int result;
@@ -392,9 +392,9 @@ void free_netconn(netconn_t *netconn)
         heap_free(netconn->extra_buf);
         netconn->extra_buf = NULL;
         netconn->extra_len = 0;
-        if (SecIsValidHandle(&netconn->ssl_ctx))
-            DeleteSecurityContext(&netconn->ssl_ctx);
     }
+    if (SecIsValidHandle(&netconn->ssl_ctx))
+        DeleteSecurityContext(&netconn->ssl_ctx);
 
     close_netconn(netconn);
     heap_free(netconn);
@@ -639,7 +639,7 @@ static BOOL send_ssl_chunk(netconn_t *conn, const void *msg, size_t size)
         {conn->ssl_sizes.cbTrailer, SECBUFFER_STREAM_TRAILER, conn->ssl_buf+conn->ssl_sizes.cbHeader+size},
         {0, SECBUFFER_EMPTY, NULL}
     };
-    SecBufferDesc buf_desc = {SECBUFFER_VERSION, sizeof(bufs)/sizeof(*bufs), bufs};
+    SecBufferDesc buf_desc = {SECBUFFER_VERSION, ARRAY_SIZE(bufs), bufs};
     SECURITY_STATUS res;
 
     memcpy(bufs[1].pvBuffer, msg, size);
@@ -698,7 +698,7 @@ static BOOL read_ssl_chunk(netconn_t *conn, void *buf, SIZE_T buf_size, BOOL blo
 {
     const SIZE_T ssl_buf_size = conn->ssl_sizes.cbHeader+conn->ssl_sizes.cbMaximumMessage+conn->ssl_sizes.cbTrailer;
     SecBuffer bufs[4];
-    SecBufferDesc buf_desc = {SECBUFFER_VERSION, sizeof(bufs)/sizeof(*bufs), bufs};
+    SecBufferDesc buf_desc = {SECBUFFER_VERSION, ARRAY_SIZE(bufs), bufs};
     SSIZE_T size, buf_len = 0;
     int i;
     SECURITY_STATUS res;
@@ -781,7 +781,7 @@ static BOOL read_ssl_chunk(netconn_t *conn, void *buf, SIZE_T buf_size, BOOL blo
         }
     } while(res != SEC_E_OK);
 
-    for(i=0; i < sizeof(bufs)/sizeof(*bufs); i++) {
+    for(i = 0; i < ARRAY_SIZE(bufs); i++) {
         if(bufs[i].BufferType == SECBUFFER_DATA) {
             size = min(buf_size, bufs[i].cbBuffer);
             memcpy(buf, bufs[i].pvBuffer, size);
@@ -798,7 +798,7 @@ static BOOL read_ssl_chunk(netconn_t *conn, void *buf, SIZE_T buf_size, BOOL blo
         }
     }
 
-    for(i=0; i < sizeof(bufs)/sizeof(*bufs); i++) {
+    for(i = 0; i < ARRAY_SIZE(bufs); i++) {
         if(bufs[i].BufferType == SECBUFFER_EXTRA) {
             conn->extra_buf = heap_alloc(bufs[i].cbBuffer);
             if(!conn->extra_buf)
diff --git a/dll/win32/wininet/urlcache.c b/dll/win32/wininet/urlcache.c
index 30a469a93a1..40e2afa49b8 100644
--- a/dll/win32/wininet/urlcache.c
+++ b/dll/win32/wininet/urlcache.c
@@ -23,6 +23,7 @@
  */
 
 #define NONAMELESSUNION
+#define NONAMELESSSTRUCT
 
 #include "ws2tcpip.h"
 
@@ -777,7 +778,7 @@ static void cache_containers_init(void)
         return;
     }
 
-    for (i = 0; i < sizeof(DefaultContainerData) / sizeof(DefaultContainerData[0]); i++)
+    for (i = 0; i < ARRAY_SIZE(DefaultContainerData); i++)
     {
         WCHAR wszCachePath[MAX_PATH];
         WCHAR wszMutexName[MAX_PATH];
@@ -1505,12 +1506,12 @@ static DWORD urlcache_hash_key(LPCSTR lpszKey)
     BYTE key[4];
     DWORD i;
 
-    for (i = 0; i < sizeof(key) / sizeof(key[0]); i++)
+    for (i = 0; i < ARRAY_SIZE(key); i++)
         key[i] = lookupTable[(*lpszKey + i) & 0xFF];
 
     for (lpszKey++; *lpszKey; lpszKey++)
     {
-        for (i = 0; i < sizeof(key) / sizeof(key[0]); i++)
+        for (i = 0; i < ARRAY_SIZE(key); i++)
             key[i] = lookupTable[*lpszKey ^ key[i]];
     }
 
@@ -2468,7 +2469,7 @@ BOOL WINAPI FreeUrlCacheSpaceW(LPCWSTR cache_path, DWORD size, DWORD filter)
         hash_table_entry = 0;
         rate_no = 0;
         GetSystemTimeAsFileTime(&cur_time);
-        while(rate_no<sizeof(rate)/sizeof(*rate) &&
+        while(rate_no < ARRAY_SIZE(rate) &&
                 urlcache_next_entry(header, &hash_table_off, &hash_table_entry, &hash_entry, &entry)) {
             if(entry->signature != URL_SIGNATURE) {
                 WARN("only url entries are currently supported\n");
@@ -3788,24 +3789,111 @@ BOOL WINAPI SetUrlCacheEntryGroupW(LPCWSTR lpszUrlName, DWORD dwFlags,
     return FALSE;
 }
 
+static cache_container *find_container(DWORD flags)
+{
+    cache_container *container;
+
+    LIST_FOR_EACH_ENTRY(container, &UrlContainers, cache_container, entry)
+    {
+        switch (flags & (CACHE_CONFIG_CONTENT_PATHS_FC | CACHE_CONFIG_COOKIES_PATHS_FC | CACHE_CONFIG_HISTORY_PATHS_FC))
+        {
+        case 0:
+        case CACHE_CONFIG_CONTENT_PATHS_FC:
+            if (container->default_entry_type == NORMAL_CACHE_ENTRY)
+                return container;
+            break;
+
+        case CACHE_CONFIG_COOKIES_PATHS_FC:
+            if (container->default_entry_type == COOKIE_CACHE_ENTRY)
+                return container;
+            break;
+
+        case CACHE_CONFIG_HISTORY_PATHS_FC:
+            if (container->default_entry_type == URLHISTORY_CACHE_ENTRY)
+                return container;
+            break;
+
+        default:
+            FIXME("flags %08x not handled\n", flags);
+            break;
+        }
+    }
+
+    return NULL;
+}
+
 /***********************************************************************
  *           GetUrlCacheConfigInfoW (WININET.@)
  */
-BOOL WINAPI GetUrlCacheConfigInfoW(LPINTERNET_CACHE_CONFIG_INFOW CacheInfo, LPDWORD size, DWORD bitmask)
+BOOL WINAPI GetUrlCacheConfigInfoW(LPINTERNET_CACHE_CONFIG_INFOW info, LPDWORD size, DWORD flags)
 {
-    FIXME("(%p, %p, %x)\n", CacheInfo, size, bitmask);
-    INTERNET_SetLastError(ERROR_INVALID_PARAMETER);
-    return FALSE;
+    cache_container *container;
+    DWORD error;
+
+    FIXME("(%p, %p, %x): semi-stub\n", info, size, flags);
+
+    if (!info || !(container = find_container(flags)))
+    {
+        INTERNET_SetLastError(ERROR_INVALID_PARAMETER);
+        return FALSE;
+    }
+
+    error = cache_container_open_index(container, MIN_BLOCK_NO);
+    if (error != ERROR_SUCCESS)
+    {
+        INTERNET_SetLastError(error);
+        return FALSE;
+    }
+
+    info->dwContainer = 0;
+    info->dwQuota = FILE_SIZE(MAX_BLOCK_NO) / 1024;
+    info->dwReserved4 = 0;
+    info->fPerUser = TRUE;
+    info->dwSyncMode = 0;
+    info->dwNumCachePaths = 1;
+    info->dwNormalUsage = 0;
+    info->dwExemptUsage = 0;
+    info->u.s.dwCacheSize = container->file_size / 1024;
+    lstrcpynW(info->u.s.CachePath, container->path, MAX_PATH);
+
+    cache_container_close_index(container);
+
+    TRACE("CachePath %s\n", debugstr_w(info->u.s.CachePath));
+
+    return TRUE;
 }
 
 /***********************************************************************
  *           GetUrlCacheConfigInfoA (WININET.@)
  */
-BOOL WINAPI GetUrlCacheConfigInfoA(LPINTERNET_CACHE_CONFIG_INFOA CacheInfo, LPDWORD size, DWORD bitmask)
+BOOL WINAPI GetUrlCacheConfigInfoA(LPINTERNET_CACHE_CONFIG_INFOA info, LPDWORD size, DWORD flags)
 {
-    FIXME("(%p, %p, %x)\n", CacheInfo, size, bitmask);
-    INTERNET_SetLastError(ERROR_INVALID_PARAMETER);
-    return FALSE;
+    INTERNET_CACHE_CONFIG_INFOW infoW;
+
+    TRACE("(%p, %p, %x)\n", info, size, flags);
+
+    if (!info)
+    {
+        INTERNET_SetLastError(ERROR_INVALID_PARAMETER);
+        return FALSE;
+    }
+
+    infoW.dwStructSize = sizeof(infoW);
+    if (!GetUrlCacheConfigInfoW(&infoW, size, flags))
+        return FALSE;
+
+    info->dwContainer = infoW.dwContainer;
+    info->dwQuota = infoW.dwQuota;
+    info->dwReserved4 = infoW.dwReserved4;
+    info->fPerUser = infoW.fPerUser;
+    info->dwSyncMode = infoW.dwSyncMode;
+    info->dwNumCachePaths = infoW.dwNumCachePaths;
+    info->dwNormalUsage = infoW.dwNormalUsage;
+    info->dwExemptUsage = infoW.dwExemptUsage;
+    info->u.s.dwCacheSize = infoW.u.s.dwCacheSize;
+    WideCharToMultiByte(CP_ACP, 0, infoW.u.s.CachePath, -1, info->u.s.CachePath, MAX_PATH, NULL, NULL);
+
+    return TRUE;
 }
 
 BOOL WINAPI GetUrlCacheGroupAttributeA( GROUPID gid, DWORD dwFlags, DWORD dwAttributes,
diff --git a/dll/win32/wininet/utility.c b/dll/win32/wininet/utility.c
index 0e67da98db0..1853e398f47 100644
--- a/dll/win32/wininet/utility.c
+++ b/dll/win32/wininet/utility.c
@@ -219,7 +219,7 @@ static const char *get_callback_name(DWORD dwInternetStatus) {
     };
     DWORD i;
 
-    for (i = 0; i < (sizeof(internet_status) / sizeof(internet_status[0])); i++) {
+    for (i = 0; i < ARRAY_SIZE(internet_status); i++) {
 	if (internet_status[i].val == dwInternetStatus) return internet_status[i].name;
     }
     return "Unknown";
diff --git a/media/doc/README.WINE b/media/doc/README.WINE
index c6c62324999..e27bd33f0e5 100644
--- a/media/doc/README.WINE
+++ b/media/doc/README.WINE
@@ -202,7 +202,7 @@ dll/win32/windowscodecsext    # Synced to WineStaging-2.9
 dll/win32/winemp3.acm         # Synced to WineStaging-4.18
 dll/win32/wing32              # Synced to WineStaging-3.3
 dll/win32/winhttp             # Synced to WineStaging-4.18
-dll/win32/wininet             # Synced to WineStaging-3.9
+dll/win32/wininet             # Synced to WineStaging-4.18
 dll/win32/winmm               # Forked at Wine-20050628
 dll/win32/winmm/midimap       # Forked at Wine-20050628
 dll/win32/winmm/wavemap       # Forked at Wine-20050628