Bugfix: Include a Basic authentication challenge when credentials are rejected

Requests rejected by Basic authentication now include a `WWW-Authenticate` header,
allowing HTTP clients to prompt for credentials.

https://github.com/restic/rest-server/issues/376
https://github.com/restic/rest-server/pull/396