Binary uploads are a new APIG feature[1] awaiting Serverless support[2].

Surprised WWW-Authenticate headers aren't passed through. May be possible with custom authorizers[3], though it's extra complexity.

---

[1] https://aws.amazon.com/blogs/compute/binary-support-for-api-...

[2] https://github.com/serverless/serverless/issues/2797

[3] http://docs.aws.amazon.com/apigateway/latest/developerguide/...