Expose WWW-Authenticate headers

Should fix #10.
I think we should leave the headers in the error?

Also, to keep the essance of the original code could this go above the `ctx.body = {}` ?

```js
ctx.type = 'json';
ctx.status = err.code;

if (err.headers)
  ctx.set(err.headers);

ctx.body = {};
['code', 'error', 'error_description'].forEach(function (key) {
  ctx.body[key] = err[key];
});
```