Only assume WWW-Authenticated on 401