Set WWW-Authenticate header for 401 responses

This is supposed to be a fast shallow check that the request looks okay,
before being handled by a backend service.

See http://tools.ietf.org/html/rfc6750#section-3
Merge pull request #279 from alphagov/varnish-light-oauth-test

Set WWW-Authenticate header for 401 responses