How to Return a HTTP 401 instead of a CXF SOAP fault for basic authentication failure?

Issue

Some clients require a response from the server to trigger basic authentication instead of proactively sending basic authentication credentials on the first request. The CXF login filter, by default, sends an HTTP 500 error with SOAP fault if basic authentication credentials are not sent.

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <soap:Fault>
      <faultcode>soap:Server</faultcode>
      <faultstring>Authentication required but no user or password was supplied</faultstring>
    </soap:Fault>
  </soap:Body>
</soap:Envelope>