Include "WWW-Authenticate" header with any Unauthorized (401) response

Any HTTP Unauthorized (401) MUST include a WWW-Authenticate header field; although Unauthorized may not be the most appropriate response in every case, it is the response that doorkeeper currently gives.