rest: fix WWW-Authenticate header