Render `WWW-Authenticate` header also for AuthenticationFailedRejection, fixes #188

When authentication fails, browsers didn't offer a possibilty to re-enter new credentials because of the missing WWW-Authenticate header. This patch changes the AuthenticationFailedRejection to include "scheme" and "params" fields, just like AuthenticationFailedRejection.