Added configuration to set challenge in UnauthorizedHttpException

I've added a configuration-option to set a custom challenge for the UnauthorizedHttpException, thrown in the AccessDeniedListener.

If you don't set a value (as it's the default), the old exception is sent, that does not have the `WWW-Authenticate`-header, even so this is against the specs - just to keep backwards-compatibility.

This can be seen as a work-around for #434, but is furthermore a way to let the user set a custom challenge.