I am familiar with the basic workings of HTTP Auth, but how does it keep track of authentication between page views? I see there is no cookie created when the initial authentication takes place.
To quote the Wikipedia article on this:
Because the BA header has to be sent with each HTTP request, the web browser needs to cache credentials for a reasonable period of time to avoid constantly prompting the user for their username and password.
So it seems your browser takes care of this for you.
A client SHOULD assume that all paths at or deeper than the depth of
the last symbolic element in the path field of the Request-URI also
are within the protection space specified by the Basic realm value of the current challenge. A client MAY preemptively send the
corresponding Authorization header with requests for resources in
that space without receipt of another challenge from the server.
So the client/browser should handle this in some way per realm.