Add www-authentication header in unauthenticated requests to the resource server