Set WWW-Authenticate header for 401 responses

This is supposed to be a fast shallow check that the request looks okay,
before being handled by a backend service.

See http://tools.ietf.org/html/rfc6750#section-3