! routing: AuthenticationFailedRejection now directly contains challenge headers to return, fixes #538

This has two consequences:
  * it's easier to implement a custom authenticators which can now
    supply the challenge headers directly instead of needing a detour
    through HttpAuthenticator.getChallengeHeaders
  * AuthenticationFailedRejection is now serializable