[FIXED JENKINS-18634] Advertise the CLI TCP port when we use HudsonAuthenticationEntryPoint

layout.jelly exposes a number of HTTP headers that the cli client uses:

X-Hudson-CLI-Port
X-Jenkins-CLI-Port
X-Jenkins-CLI2-Port
X-Jenkins-CLI-Host

Because HudsonAuthenticationEntryPoint doesn't use that layout when it serves a 403, the necessary HTTP headers are missing. If the redirection is external (as is the case with the openid plugin), it breaks CLI support completely.

Bug is here: https://issues.jenkins-ci.org/browse/JENKINS-18634