as IMO this case should somehow "bubble up" to shiro filters, that already have the means (and know things like supported auth schemes to send challenge), as the old code was very wrong here, it simply a) duplicated things, b) assumed NxBasic auth scheme... But ideas are welcome