Added option for configuration of force login header

If force login is not active, then REST controller won't send a HTTP
header about authentication ("WWW-Authenticate").
This is most significant if you use custom login process on a web
application side (ex. custom login dialog).