also set WWW-authenticate header when 401 page is not set
remove inaccurate file path stripping which causes bug