also return a 'www-authenticate' header