Always pass WWW-Authenticate (for Kerberos)