Zend\Authentication\Adapter\Http::_challengeClient() should be public since one could need to call it this way:

<code>$auth->getAdapter()->challengeClient();</code>

for instance when the authenticated user tries to access a resource for which he is not granted by ACLs.