Add www-authenticate header on unauthorized response.