add WWW-Authenticate header for convenience