Allow HTTP mechanisms to decide if response should be sent when authentication is in progress

Currently, mechanisms are not allowed to decide if a challenge should be sent or not when processing a request to path where authentication is not required.

Currently, we always write to the response regardless if authentication if required or not, making impossible to mechanisms decide what you do in cases where a request is a for a non-protected resource and an authentication challenge should not be sent.