Add correct token rendering and failure response when using bearer tokens.

According to the RFC7650 specification, when a protected resource does not have
a valid token (or a missing token), the server should respond with a
WWW-Authenticate header.

When issuing a token to a client (upon successful authentication), the token's
format should match that which is defined in RFC6750 as well.

This resolves the remaining issues mentioned in #73.