Authentication: ensure no-403 setting is check each time access needs to be forbidden

Furthermore, this commit avoid “500 internal error” response while chalenge making when no algorithm fetched from database has been allowed in settings. A challenge for each allowed algorithms is made instead.