Update response code when the authorization header is missing.
Add separate checks for when the auth header is missing and when it is
malformed (not basic auth).