When RESTXQ detects a security error, it should not fail with a 500.

Instead initiate a basic auth handshake (401), so that the
user can retry the request with the correct level or authorisation.