https://bz.apache.org/bugzilla/show_bug.cgi?id=62025
https://stackoverflow.com/questions/46220113/remove-www-authenticate-header?rq=1

--- apache2-2.4.29.orig/modules/metadata/mod_headers.c
+++ apache2-2.4.29/modules/metadata/mod_headers.c
@@ -904,6 +904,7 @@ static apr_status_t ap_headers_error_fil
      * Server-wide first, then per-directory to allow overriding.
      */
     do_headers_fixup(f->r, f->r->err_headers_out, dirconf->fixup_err, 0);
+    do_headers_fixup(f->r, f->r->headers_out, dirconf->fixup_out, 0);
 
     /*
      * We've done our bit; remove ourself from the filter chain so there's