Fix ChainBundle (temporary)

lib_xenia/src/main/x/xenia/ChainBundle.x

@@ -17,6 +17,7 @@ import web.AcceptList;
 import web.Body;
 import web.BodyParam;
 import web.ErrorHandler;
+import web.Header;
 import web.HttpMethod;
 import web.HttpStatus;
 import web.MediaType;
@@ -300,6 +301,7 @@ service ChainBundle {
             }
 
             import Authenticator.Attempt;
+            import Authenticator.AuthResponse;
             import Authenticator.Status as AuthStatus;
 
             Attempt[] attempts = authenticator.authenticate(request);
@@ -331,9 +333,31 @@ service ChainBundle {
 //                        return True, new SimpleResponse(Forbidden);
 //                    }
             } else {
-                  // "authResult" is actually an HTTP response to send back to the client to
-                  // take the next step in the authentication process
-                  return True, attempts[0].response.as(ResponseOut);
+                // REVIEW CP merge
+                MergeAttempts:
+                for (Attempt attempt : attempts) {
+                    AuthResponse? authResponse = attempt.response;
+                    switch (authResponse.is(_)) {
+                    case Nullable:
+                        continue MergeAttempts;
+
+                    case String:
+                        SimpleResponse response = new SimpleResponse(Unauthorized);
+                        response.add(Header.WWWAuthenticate, authResponse);
+                        return True, response;
+
+                    case Array<String>:
+                        SimpleResponse response = new SimpleResponse(Unauthorized);
+                        authResponse.forEach(r -> response.add(Header.WWWAuthenticate, r));
+                        return True, response;
+
+                    case HttpStatus:
+                        return True, new SimpleResponse(authResponse);
+
+                    case ResponseOut:
+                        return True, authResponse;
+                    }
+                }
             }
 
             if (resolvePermission != Null) {