Return 401 when policy not set to "force" the client to display basic auth popup