...
Back at the browser, the browser decrypts attempts to decrypt the challenge with the user's password to get the answer to the challenge, which the browser then sends to the web server as proof that the user is who they claim to be. If the web server determines that the answer is correct, the web server sends the requested page to the browser.
...