make ArangoDB not send back a `WWW-Authenticate` header

make ArangoDB not send back a `WWW-Authenticate` header to a client in case the
client sends the `X-Requested-With` header with a value of `XMLHttpRequest`

This is done to prevent browsers from showing their built-in HTTP authentication
dialog for AJAX requests that require authentication.
ArangoDB will still return an HTTP 401 (Unauthorized) if the request doesn't
contain valid credentials, but it will omit the `WWW-Authenticate` header,
allowing clients to bypass the browser's authentication dialog.
fixed failing test