added WWW-Authenticate header