Adjust the HTTP Authenticator so the first non OK status code wins.

Later mechanisms may perform an action that prevents the status code from being subsequently set so the first mechanism to select a status code that is not 200 should 'win'.