WWW-Authenticate header on 401 (Unauthorized)