add WWW-Authenticate header in response for error 400 and 403 as well as 401