Thanku Zib, that's what I meant
After reading the php manual, I see 2 headers are required:
header('WWW-Authenticate: Basic realm="Test Authentication System"');
header('HTTP/1.0 401 Unauthorized');
This forces a 401-error directly managed by the webserver: what I wanted!
Thanku