[Reviewer: Graeme] Quote params in WWW-Authenticate header

Graeme, can you review this fix to quote the params in the WWW-Authenticate header
Tested in UTs. 

Fixes #1 
Just tidying up given it's already been commented out