Core Issue
The end point sends the re-invite when a user does a transfer, or the Auto-Attendant transfers a call that has already been authenticated.
Resolution
It does not matter whether this is an invite or re-invite. As long as authentication is turned on, any request that comes into the SFP is challenged. The SFP challenges the outgoing re-invite with the 407 Proxy Authentication Required response unless the message already contains the user's credentials in it.