the ACK after the failed INVITE is correct and required by the RFC.
But there should be a new INVITE after the ACK as a new transaction (e.g. new CSeq Header). And this new INVITE should contain the authorization header.
If this info does not help you might send me the packet trace or the Net::SIP Debugging ( -MNet::SIP::Debug=100) to me at steffen[AT]genua[DOT]de.