support the spec of 'invalid_token' response

WWW-Authenticate header is required when not authenticate error.
see it: http://tools.ietf.org/html/rfc6750\#section-3