! routing: AuthenticationFailedRejection now directly contains challenge headers to return, fixes #538

This has two consequences:
  * it's easier to implement a custom authenticators which can now
    supply the challenge headers directly instead of needing a detour
    through HttpAuthenticator.getChallengeHeaders
  * AuthenticationFailedRejection is now serializable
Merge pull request #541 from jrudolph/i/538/better-AuthenticationFailedRejection

! routing: AuthenticationFailedRejection now directly contains challenge headers to return, fixes #538