Determine WWW-Authenticate header using all authentication classes

When trying to determine the `WWW-Authenticate` header (https://github.com/tomchristie/django-rest-framework/blob/12394c9cacef0c92ef5b9d31836612e52a26e57a/rest_framework/views.py#L144-L151), until now the first available authentication class is used. If it doesn't provide any header (see the `SessionAuthentication` class as an example), `None` is returned, even though there might be another authentication class which does provide a valid header.

With this commit, `get_authenticate_header()` iterates through all available authentication classes, until it finds one that provides a valid header (if any).

A use case where the current behavior is a problem is the default configuration:

```python
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.BasicAuthentication',
     ),
```

Even though basic auth provides a valid `WWW-Authenticate` header, a HTTP 403 status is returned when a permission check fails.

Tests to cover this change are provided in this PR.

(The CSRF fix is needed to properly pass the tests after the WWW-Authenticate commit has been added.)