add WWW-Authenticate header

it makes the example more clear imho