To initiate basic auth, the server should respond with a 401 Not Authorized, not a 403 Forbidden (see https://en.wikipedia.org/wiki/Basic_access_authentication)