challenge unauthenticated users for credentials as opposed to giving a 200 with an error saying the layer is not there