Set WWW-Authenticate response header

when no authorization token is provided by client

as specified in OAuth 2.0 spec at
http://self-issued.info/docs/draft-ietf-oauth-v2-bearer.html#authn-header