According to RFC-2616: "The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response. " (https://w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.4). However, when a HEAD method returns an HTTP 401 Unauthorized response it returns a body "access denied". This breaks, in particular, the Cyberduck client app, which expects the server to be well-behaved.
According to RFC-2616: "The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response. " (https://w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.4). However, when a HEAD method returns an HTTP 401 Unauthorized response it returns a body "access denied". This breaks, in particular, the Cyberduck client app, which expects the server to be well-behaved.