How to protect page with www-authenticate header when server rendering

[maiksch]

I am trying to build a site with a small admin section that only users with a username and password can access. What I have right now is an admin page admin.svelte and a page endpoint admin.ts which returns a 401 status with a www-authenticate: basic header like so:

import type { RequestHandler } from '@sveltejs/kit';

export const get: RequestHandler = async () => {
    return {
        status: 401,
        headers: {
            'www-authenticate': 'Basic'
	}
    };
};

For some reason, the login prompt is only shown when I access the page via the router, i.e. when I navigate from / to /admin and the svelte router did the work. In the network tab I can see the request to the /admin/__data.json endpoint, which includes the authenticate header.
But when I access /admin directly and get the server-rendered version, the status 401 gets set but the authenticate header is missing from the response headers.

How can I get the server-rendered page to include authenticate header and show me the browser login prompt, like it does after client side navigation?