code: def denied_response(self, req):
          
          if not hasattr(req, 'credentials_valid'):
              req.credentials_valid = None
          if req.remote_user or req.credentials_valid:
              return HTTPForbidden(request=req)
          else:
              return HTTPUnauthorized(request=req)
docs: Returns a standard WSGI response callable with the status of 403 or 401
          depending on whether the REMOTE_USER is set or not.