Make TokenAuthentication RFC2617 compliant

RFC2617[0] requires that the scheme in the WWW-Authenticate header is `followed by a comma-separated list of attribute-value pairs which carry the parameters necessary for achieving authentication via that scheme.`. That list must not be empty: `challenge = auth-scheme 1*SP 1#auth-param`.

[0] http://tools.ietf.org/html/rfc2617#section-1.2