Remove Challenge from ParseAuthorizationHeader

I noticed that if the header is empty, we return null and let the caller issue a Challenge as they see fit. With tokens.Length < 2, though, we called Challenge and then returned null, in which case the caller probably calls Challenge again. Deferring Challenge to the caller in both cases seemed more consistent to me.