Wrap realm & scope values in "" on 401 errors

The absense of these won't affect most clients but we should consider the few clients (experienced only one so far) that are sensitive to this ... an example ...

On Android, the lack of "" wrapping on realm caused the Java to throw exceptions when trying to read the response code (Android assumes that when we 401 (Unauthorize). The HTTP connection library that Google recommends (HttpUrlConnection) is very strict with errors as well and expects the WWW-Authenticate header to be set and seemingly with the "" ...

Looking at the [The WWW-Authenticate Response Header](http://tools.ietf.org/html/rfc2617#section-3.2.1) spec they seem to imply that the values should be in quotes ... but its not 100% clear.

Some examples I found;

```
header('WWW-Authenticate: OAuth realm="users"');
header('HTTP/1.1 401 Unauthorized');
```

Also wrapped scope with "" anyway

Ps: This solved my issued on an android app connecting to my oauth2-server