Send proper 401 error and header when user authentication fails.