Only add WWW-Authenticate headers to NOT_AUTHORIZED responses