Fix for handling multiple strategies

Following issue #307 in hapijs, it is necessary to use the scheme name
as the second parameter to Boom.unauthorized().

Added test for multiple strategies