401 on failed auth; no www-authenticate prompt (browsers take over, grim not want)