auth: fix WWW-Authenticate header for /validate