refactoring auth
remove blank line before WWW-Authenticate header