Set WWW-Authenticate header/401 status on Bearer failure