[Reviewer: Graeme] Quote params in WWW-Authenticate header

Graeme, can you review this fix to quote the params in the WWW-Authenticate header
Tested in UTs. 

Fixes #1 
Fine, was just checking it wasn't some sort of horrible accident