Return a WWW-Authenticate challenge header when the supplied token is
invalid.