move Connection header so it is applied to failed authentication
attempts as well.

ok @davecgh