The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8).
The response should contain a WWW-Authenticate header field (section 14.47) that includes a suitable challenge for the requested resource, and the client can resubmit the request using an Authorization header field (section 14.8).