PROV-639 Require authentication via HTTP header for JSON service API upon failed request

Otherwise modern browsers are (rightfully) very reluctant to send login
data along with the request.