[Reviewer: Graeme] Quote params in WWW-Authenticate header

Graeme, can you review this fix to quote the params in the WWW-Authenticate header
Tested in UTs. 

Fixes #1 
Also, you use a `.` as a literal without escaping it.