Send WWW-Authenticate header on unauthorized