We use basic auth but after installing a StatusPages handler for HttpStatusCode.Unauthorized I no longer get a challenge when accessing the protected urls. Any hints for fixing this ? Maybe its a bug ?

Did you try to debug the statusPage to see if there is an error being handled there? I guess it is the logical step