Use WWW-Authenticate header to return AP info

This change returns AP info in a WWW-Authenticate header, in 401 responses to protected resources.