Make use of `:unauthenticated-handler` in the `http-basic` workflow.

Setting the `:unauthenticated-handler` had no effect previously. If not set, the call to `http-basic-deny` still takes place as it did before.