RFC 7235 - Hypertext Transfer Protocol (HTTP/1.1): Authentication
https://tools.ietf.org/html/rfc7235#section-3.1
> The server generating a 401 response MUST send a WWW-Authenticate header field (Section 4.1) containing at least one challenge applicable to the target resource.