Add auth challenge to response

JS bug: XMLHttpRequest doesn’t return all headers