Set WWW-Authenticate header for 401 responses

This is supposed to be a fast shallow check that the request looks okay,
before being handled by a backend service.