Fixed the admin key handler to require a 401 header before challenging