There is documentation about this here. My advice is to make your authentication handler run in the authentication phase, rather than trying to jam it into the response phase.