Improper handling of 401 authentication failures

[idletea]

In a call flow such as

• send REGISTER
• get 401 response with auth challenge
• send REGISTER with valid authentication
• get 401 response with no challenge (ie: your credentials are fine, but still denied)

The client will continue to retransmit the request with the authorization header