Authentication does not work behind Knox gateway because the "WWW-Authenticate: Negotiate" response header is missing

HIVE-27661 refactored the authentication code a bit and also introduced a new bug: 
Before the modification, if the client was not authenticated and Kerberos authentication was enabled, a response header was included in the HTTP 401 response: WWW-Authenticate: Negotiate  
After the modification, this header is not included in the response, so the reactive authentication flow implemented in the Knox gateway does not work anymore.