add WWW-Authenticate

browser will be happy with this change.