Update the HTTP status code handling within HTTP authentication to cover the following scenarios: -

1. If authentication is required and no mechanisms are available report status 500.
2. If a mechanism fails by throwing an exception and no other mechanisms are able to challenge report status 500.
3. If a mechanism fails but other mechanisms can still challenge use the challenge from the available mechanisms.
4. If mechanisms were available but none authenticated and none able to challenge report status 403.