added custom AuthEntryPoint to avoid sending a WWW-Authenticate Header if the provided login data is invalid