Merge pull request #318 from crowdlab-uk/invalid_token_response

Include "WWW-Authenticate" header with any Unauthorized (401) response
CHANGELOG update