return auth denied if no auth header present on http-basic workflow.

currently the http-basic auth scheme fails since when the user comes unauthenticated redirects to /login instead of asking for credentials.