I started getting reports yesterday that changes.xml has been inaccessible, it appears to behind a password dialog. Some people didn't complain because they thought this was a policy change. It is not.
There's some kind of problem with IIS, I can't find any evidence that the site has any access controls through the system manager user interface. I tried re-creating the site from scratch, and at first it worked, and I thought the problem was solved (this was yesterday at about 8PM Eastern) but I just checked at 2:30AM Eastern, and it's asking for a username and password again.
Okay, so I am now moving the static files to Apache, that should take care of this problem, but may create others. Stay tuned.
Update: The change I made appears to have worked. I'm going to have to revisit this since I switched to a server with relatively expensive bandwidth. But it's important to have this resource online and available. Sorry for the outage and please if there are any problems, let me know. Thanks!