re-add message if credentials are missing

coming from #143 the status-code gets changed from `400` to `401` - which looks good to me. but in the same change, the content gets lost? (Commit https://github.com/bshaffer/oauth2-server-php/commit/fed2a717c20bf9da479a161f9e9b126b83bcff94#diff-1)

      % curl -ik https://project.tld/endpoint
    HTTP/1.1 401 Unauthorized
    WWW-Authenticate: bearer realm="Project API"

    {}

With this PR, we get the same information as we had before (of course with the correct status-code):

      % curl -ik https://project.tld/endpoint
    HTTP/1.1 401 Unauthorized
    WWW-Authenticate: bearer realm="Project API", error="invalid_request", error_description="The access token was not found"

    {"error":"invalid_request","error_description":"The access token was not found"}