[Reviewer: Graeme] Quote params in WWW-Authenticate header

Graeme, can you review this fix to quote the params in the WWW-Authenticate header
Tested in UTs. 

Fixes #1 
Should the value of the stale parameter be quoted too? The RFC seems a bit inconsistent on it, so maybe it doesn't matter...