How to configure HTTP Header Authentication to fail when "username is empty"

We've followed the confusing combination of Support Doc ID 2457010.1 (so imprecise!) and the App Builder Users Guide section on HTTP Header Variable authentication (at https://docs.oracle.com/en/database/oracle/apex/24.2/htmdb/http.header-variable.html#GUID-DCF33CEF-0996-4AAF-89A3-D7E2589E5585) to configure a functional HTTP Header authentication using OAM.

BUT, if we're basically "backing in" to authentication by redirecting the "username is empty" error to "built-in url" and then protecting said URL (currently documented as apex_authentication.callback) by a WebGate, how do we configure this authentication scheme to catch a true "username is empty" error? If external authentication results in an empty username (doesn't set the HTTP header, for instance), the Scheme redirects to authentication_callback until the browser stops trying with ERR_TOO_MANY_REDIRECTS.