Only set WWW-Authenticate header on 401 responses.