OBMFULL-5934 Always return WWW-Authenticate with a 401.

As per the RFC. Otherwise, the user is not prompted again for a password upon
login failure.
OBMFULL-6006 Attendee completion requests run in parallel.

Previously, PHP, due to its session-handling mechanism, processed the attendee
autocompletion requests sequentially for a given session (users first and
contacts second).