* parameterize behaviour when responding to unauthenticated requests
  that require authentication (new :unauthenticated-handler option)
* don't automatically send http-basic denial when http-basic creds aren't provided
* fixes gh-38