support the spec of 'invalid_token' response

WWW-Authenticate header is required when authenticate error.
see it: http://tools.ietf.org/html/rfc6750\#section-3
Better error responses, including more use of WWW-Authenticate
Do not force a Content-Type when handling unauthorized errors
Make the InvalidTokenResponse object available to views
Replace spec stubs with doubles
Refactor InvalidTokenResponse.from_access_token
Fix broken specs
Require Doorkeeper::OAuth::InvalidTokenResponse
Merge pull request #318 from crowdlab-uk/invalid_token_response

Include "WWW-Authenticate" header with any Unauthorized (401) response
CHANGELOG update