Include WWW-Authenticate-header with both 401 responses