auth info in body/json instead of WWW-Authenticate field