set XXX-Authenticate header if unauthorized