rfc basic auth challenge

Should make basic auth more rfc compliant by making a challenge response with HTTP 401 code if the client did not send or sent wrong authentication credentials.

   if basic_auth_realm is defined is a callable it's return value
   is used to set the basic authentication realm, if it's a string
   its content is used instead.  Otherwise basic authentication realm
   is set to the application name.
   If basic_auth_realm is None or False (the default) the behavior
   is to skip sending any challenge.