Docmentation: HTTP auth handler should send response when denying access

See #1142

docs/api/mg_set_auth_handler.md

@@ -23,8 +23,17 @@ The function `mg_set_auth_handler()` hooks an authorization function to an URI t
 
 The callback function can return **0** to deny access, and **1** to allow access.
 
+To allow maximum flexibility in the HTTP response status code and message when denying access, the callback should
+send the HTTP response itself. 
+The callback may send use [`mg_send_digest_access_authentication_request`](mg_send_digest_access_authentication_request.md) to ask for http digest authentication,
+it may send a http 403 status code using `mg_send_http_error`](mg_set_request_handler.md), 
+or a 303 redirect to a login page using [`mg_send_http_redirect`](mg_send_http_redirect.md) 
+or any other response.
+
 The `mg_set_auth_handler()` function is very similar in use to [`mg_set_request_handler()`](mg_set_request_handler.md).
 
 ### See Also
 
 * [`mg_set_request_handler();`](mg_set_request_handler.md)
+* [`mg_send_http_error();`](mg_set_request_handler.md)
+* [`mg_send_http_redirect();`](mg_send_http_redirect.md)