fix problem that ajax requests don't get a www-authenticate header as long we don't have a form-login