Return valid WWW-Authenticate HTTP on authentication error.

Fixes #503