auth: include Basic challenge in 401 responses

Requests rejected by Basic authentication currently return 401 without WWW-Authenticate, preventing HTTP clients from prompting for credentials. Advertise the Basic scheme on the server and metrics auth paths while leaving proxy authentication unchanged.

mux.go

@@ -56,11 +56,18 @@ func (s *Server) checkAuth(r *http.Request) (username string, ok bool) {
 	return username, true
 }
 
+func (s *Server) writeUnauthorized(w http.ResponseWriter) {
+	if !s.NoAuth && s.ProxyAuthUsername == "" {
+		w.Header().Set("WWW-Authenticate", `Basic realm="rest-server"`)
+	}
+	httpDefaultError(w, http.StatusUnauthorized)
+}
+
 func (s *Server) wrapMetricsAuth(f http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		username, ok := s.checkAuth(r)
 		if !ok {
-			httpDefaultError(w, http.StatusUnauthorized)
+			s.writeUnauthorized(w)
 			return
 		}
 		if s.PrivateRepos && username != "metrics" {