return WWW-Authenticate header on 401s (missing in test)