Expose the WWW-Authenticate header for CORS responses so the client can handle auth responses correctly.