[Reviewer: Graeme] Quote params in WWW-Authenticate header

Graeme, can you review this fix to quote the params in the WWW-Authenticate header
Tested in UTs. 

Fixes #1 
It does, so I'm adding quotes to be safe