Check Authorization / WWW-Authenticate headers

Does this irule do what you want?

when HTTP_REQUEST {
    if {[catch {set username [HTTP::username] }]} { set username ""}
    if { ($username ne "") && ([lsearch $userlist $username] equals -1 )} { HTTP::respond 403 content "Access is Denied!" }   
}

when HTTP_RESPONSE {
  if { ([HTTP::status] eq "401") && !([HTTP::header WWW-Authenticate] contains "Basic") } { HTTP::respond 403 content "Access is Denied!" }
}