oops. pass the sender the challenge in willSendRequestForAuthenticationChallenge: