`Authorization` is the header likely to be seen, not `WWW-Authenticate`

During a quick review of my SRI patch for Firefox, one of the network
engineers pointed this out:

> Checking for WWW-Authenticate is a non-sense.  It will never pop-up
> here.  Only when credentials are not provided and the channel just
> propagates the 401 response in which case the load fails anyway.
>
> You should rather check for the "Authorization" request header.

Assuming this is also the case in Chrome, we should change the
spec to make it easier for implementers.
Merge pull request #108 from fmarier/rename-www-authenticate

Check `Authorization` header in addition to `WWW-Authenticate`