Just tested it out, it has the space:

```
HTTP/1.1 401 Unauthorized
Server: GitHub.com
Date: Mon, 24 Mar 2014 22:13:24 GMT
Content-Type: application/json; charset=utf-8
Status: 401 Unauthorized
X-GitHub-OTP: required; app
X-GitHub-Media-Type: github.v3; format=json
X-Content-Type-Options: nosniff
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 57
X-RateLimit-Reset: 1395702714
Content-Length: 169
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: ETag, Link, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval
Access-Control-Allow-Origin: *
```