REST: remove WWW-Authenticate on unauthorized requests.

This prevents normal clients/browsers to prompt for a password.