fix for possible double remove auth trigger.

in cases where no content has been sent to an authenticated listener, the remove routine refers
the client to sending a 404 but did not remove the authenticed flag.  Eventually the client
after completing the 404 response went back to remove auth.  Now we just drop the flag the first
time through in all cases.