Trying to understand the negotiation process

Hi

We have an asp.net site that is set to use Windows integrated authentication on our Windows intranet. What I have noticed is that the first time I request any object from the site after an IISRESET the request 'fails' and the browser throws up a Windows Security authentication dialog box. After pressing Cancel thereafter any browsing is fine. Using Fiddler I can see that there is one request that ends up with a 401 response. Is this standard practise that the first request of any site should respond with security box?

Thanks to any one who can shed light on this behaviour.