diff --git a/desktop/401login.h b/desktop/401login.h
index 8b5a0a778..dec3fa5e1 100644
--- a/desktop/401login.h
+++ b/desktop/401login.h
@@ -19,12 +19,12 @@
 #ifndef NETSURF_DESKTOP_401LOGIN_H
 #define NETSURF_DESKTOP_401LOGIN_H
 
+#include <stdbool.h>
+
 #include "utils/config.h"
+#include "utils/errors.h"
 
-struct hlcache_handle;
-struct browser_window;
-
-void gui_401login_open(struct browser_window *bw, struct hlcache_handle *c,
-		const char *realm);
+void gui_401login_open(const char *url, const char *realm,
+			nserror (*cb)(bool proceed, void *pw), void *cbpw);
 
 #endif
diff --git a/desktop/gui.h b/desktop/gui.h
index 80ba33cc8..5c53cf694 100644
--- a/desktop/gui.h
+++ b/desktop/gui.h
@@ -134,7 +134,8 @@ bool gui_search_term_highlighted(struct gui_window *g,
 
 struct ssl_cert_info;
 
-void gui_cert_verify(struct browser_window *bw, hlcache_handle *c,
-		const struct ssl_cert_info *certs, unsigned long num);
+void gui_cert_verify(const char *url, const struct ssl_cert_info *certs, 
+		unsigned long num, nserror (*cb)(bool proceed, void *pw),
+		void *cbpw);
 
 #endif
diff --git a/desktop/netsurf.c b/desktop/netsurf.c
index f19632026..2ce1012c2 100644
--- a/desktop/netsurf.c
+++ b/desktop/netsurf.c
@@ -36,6 +36,7 @@
 #include "content/hlcache.h"
 #include "content/urldb.h"
 #include "desktop/netsurf.h"
+#include "desktop/401login.h"
 #include "desktop/browser.h"
 #include "desktop/gui.h"
 #include "desktop/options.h"
@@ -53,6 +54,35 @@ static void *netsurf_lwc_alloc(void *ptr, size_t len, void *pw)
 	return realloc(ptr, len);
 }
 
+/**
+ * Dispatch a low-level cache query to the frontend
+ *
+ * \param query  Query descriptor
+ * \param pw     Private data
+ * \param cb     Continuation callback
+ * \param cbpw   Private data for continuation
+ * \return NSERROR_OK
+ */
+static nserror netsurf_llcache_query_handler(const llcache_query *query,
+		void *pw, llcache_query_response cb, void *cbpw)
+{
+	switch (query->type) {
+	case LLCACHE_QUERY_AUTH:
+		gui_401login_open(query->url, query->data.auth.realm, cb, cbpw);
+		break;
+	case LLCACHE_QUERY_REDIRECT:
+		/** \todo Need redirect query dialog */
+		/* For now, do nothing, as this query type isn't emitted yet */
+		break;
+	case LLCACHE_QUERY_SSL:
+		gui_cert_verify(query->url, query->data.ssl.certs, 
+				query->data.ssl.num, cb, cbpw);
+		break;
+	}
+
+	return NSERROR_OK;
+}
+
 /**
  * Initialise components used by gui NetSurf.
  */
@@ -124,8 +154,7 @@ nserror netsurf_init(int *pargc,
 
 	fetch_init();
 
-	/** \todo The frontend needs to provide the llcache_query_handler */
-	llcache_initialise(NULL, NULL);
+	llcache_initialise(netsurf_llcache_query_handler, NULL);
 
 	return NSERROR_OK;
 }
diff --git a/gtk/gtk_gui.c b/gtk/gtk_gui.c
index ebe5d96ff..9d0c04bbb 100644
--- a/gtk/gtk_gui.c
+++ b/gtk/gtk_gui.c
@@ -659,18 +659,20 @@ void hotlist_visited(hlcache_handle *content)
 {
 }
 
-void gui_cert_verify(struct browser_window *bw, hlcache_handle *c,
-		const struct ssl_cert_info *certs, unsigned long num)
+void gui_cert_verify(const char *url, const struct ssl_cert_info *certs, 
+		unsigned long num, nserror (*cb)(bool proceed, void *pw),
+		void *cbpw)
 {
 	GladeXML *x = glade_xml_new(glade_ssl_file_location, NULL, NULL);
 	GtkWindow *wnd = GTK_WINDOW(glade_xml_get_widget(x, "wndSSLProblem"));
 	GtkButton *accept, *reject;
-	void **session = calloc(sizeof(void *), 4);
+	void **session = calloc(sizeof(void *), 5);
 
-	session[0] = bw;
-	session[1] = strdup(content_get_url(c));
-	session[2] = x;
-	session[3] = wnd;
+	session[0] = strdup(url);
+	session[1] = cb;
+	session[2] = cbpw;
+	session[3] = x;
+	session[4] = wnd;
 
 	accept = GTK_BUTTON(glade_xml_get_widget(x, "sslaccept"));
 	reject = GTK_BUTTON(glade_xml_get_widget(x, "sslreject"));
@@ -687,13 +689,15 @@ void gui_cert_verify(struct browser_window *bw, hlcache_handle *c,
 void nsgtk_ssl_accept(GtkButton *w, gpointer data)
 {
 	void **session = data;
-	struct browser_window *bw = session[0];
-	char *url = session[1];
-	GladeXML *x = session[2];
-	GtkWindow *wnd = session[3];
+	char *url = session[0];
+	nserror (*cb)(bool proceed, void *pw) = session[1];
+	void *cbpw = session[2];
+	GladeXML *x = session[3];
+	GtkWindow *wnd = session[4];
 
   	urldb_set_cert_permissions(url, true);
-	browser_window_go(bw, url, 0, true);
+
+	cb(true, cbpw);
 
 	gtk_widget_destroy(GTK_WIDGET(wnd));
 	g_object_unref(G_OBJECT(x));
@@ -705,12 +709,16 @@ void nsgtk_ssl_accept(GtkButton *w, gpointer data)
 void nsgtk_ssl_reject(GtkButton *w, gpointer data)
 {
 	void **session = data;
-	GladeXML *x = session[2];
-	GtkWindow *wnd = session[3];
+	nserror (*cb)(bool proceed, void *pw) = session[1];
+	void *cbpw = session[2];
+	GladeXML *x = session[3];
+	GtkWindow *wnd = session[4];
+
+	cb(false, cbpw);
 
 	gtk_widget_destroy(GTK_WIDGET(wnd));
 	g_object_unref(G_OBJECT(x));
-	free(session[1]);
+	free(session[0]);
 	free(session);
 }
 
diff --git a/gtk/gtk_login.c b/gtk/gtk_login.c
index ed6f92407..4b9f15333 100644
--- a/gtk/gtk_login.c
+++ b/gtk/gtk_login.c
@@ -38,36 +38,38 @@ struct session_401 {
 	char *url;				/**< URL being fetched */
 	char *host;				/**< Host for user display */
 	char *realm;				/**< Authentication realm */
-	struct browser_window *bw;		/**< Browser window handle */
+	nserror (*cb)(bool proceed, void *pw);	/**< Continuation callback */
+	void *cbpw;				/**< Continuation data */
 	GladeXML *x;				/**< Our glade windows */
 	GtkWindow *wnd;				/**< The login window itself */
 	GtkEntry *user;				/**< Widget with username */
 	GtkEntry *pass;				/**< Widget with password */
 };
 
-static void create_login_window(struct browser_window *bw, const char *host,
-                const char *realm, const char *fetchurl);
+static void create_login_window(const char *url, const char *host,
+                const char *realm, nserror (*cb)(bool proceed, void *pw),
+		void *cbpw);
 static void destroy_login_window(struct session_401 *session);
 static void nsgtk_login_next(GtkWidget *w, gpointer data);
 static void nsgtk_login_ok_clicked(GtkButton *w, gpointer data);
 static void nsgtk_login_cancel_clicked(GtkButton *w, gpointer data);
 
-void gui_401login_open(struct browser_window *bw, hlcache_handle *c,
-		const char *realm)
+void gui_401login_open(const char *url, const char *realm,
+		nserror (*cb)(bool proceed, void *pw), void *cbpw)
 {
 	char *host;
 	url_func_result res;
 
-	res = url_host(content_get_url(c), &host);
+	res = url_host(url, &host);
 	assert(res == URL_FUNC_OK);
 
-	create_login_window(bw, host, realm, content_get_url(c));
+	create_login_window(url, host, realm, cb, cbpw);
 
 	free(host);
 }
 
-void create_login_window(struct browser_window *bw, const char *host,
-		const char *realm, const char *fetchurl)
+void create_login_window(const char *url, const char *host, const char *realm, 
+		nserror (*cb)(bool proceed, void *pw), void *cbpw)
 {
 	struct session_401 *session;
 
@@ -91,10 +93,11 @@ void create_login_window(struct browser_window *bw, const char *host,
 	/* create and fill in our session structure */
 
 	session = calloc(1, sizeof(struct session_401));
-	session->url = strdup(fetchurl);
+	session->url = strdup(url);
 	session->host = strdup(host);
 	session->realm = strdup(realm ? realm : "Secure Area");
-	session->bw = bw;
+	session->cb = cb;
+	session->cbpw = cbpw;
 	session->x = x;
 	session->wnd = wnd;
 	session->user = euser;
@@ -163,13 +166,17 @@ void nsgtk_login_ok_clicked(GtkButton *w, gpointer data)
 	urldb_set_auth_details(session->url, session->realm, auth);
 	free(auth);
 
-	browser_window_go(session->bw, session->url, 0, true);
+	session->cb(true, session->cbpw);
 
 	destroy_login_window(session);
 }
 
 void nsgtk_login_cancel_clicked(GtkButton *w, gpointer data)
 {
-	/* just close and destroy the window */
-	destroy_login_window((struct session_401 *)data);
+	struct session_401 *session = (struct session_401 *) data;
+
+	session->cb(false, session->cbpw);
+
+	/* close and destroy the window */
+	destroy_login_window(session);
 }