add assert for WWW-Authenticate Header on missing credentials