#7 401 Unauthorised responses must have WWW-Authenticate field

[Laurens Holst]

Quote from the HTTP specification for the 401
Unauthorised response (rfc2616 10.4.2):

"The response MUST include a WWW-Authenticate header
field."

We rarely (if ever) do this, now.

~Grauw