since it's an AUTHENTICATE request, shoudn't we generate a 4XX response and stop the propagation ?