remove Server http header in auth failure response