return WWW-Authenticate header on 401s for Grant (+ blank response body)