[Reviewer Matt] Set stale=true in WWW-Authenticate header 

Matt

Can you review this change to set stale=true in WWW-Authenticate headers when appropriate (basically when the Authorization header contains a challenge response which we can't authenticate because we can't find the AV).  I've tested in a UT, but not live.

This should be the last change required for issue 631.

Mike