include WWW-Authenticate header when insufficient_scope error
separate "JSON Response" and "WWW-Authenticate header" into 2 tests