OBMFULL-5934 Always return WWW-Authenticate with a 401.

As per the RFC. Otherwise, the user is not prompted again for a password upon
login failure.