Rather than spending time worrying about whether or not a 401 is likely to cause troubles because of WWW-Authenticate interactions, if the Persona folks don't have a specific suggestion here, I'd propose just doing the conservative thing and going with 400.