`Authorization` is the header likely to be seen, not `WWW-Authenticate`

During a quick review of my SRI patch for Firefox, one of the network
engineers [pointed this out](https://bugzilla.mozilla.org/show_bug.cgi?id=992096#c24):

> Checking for WWW-Authenticate is a non-sense.  It will never pop-up
> here.  Only when credentials are not provided and the channel just
> propagates the 401 response in which case the load fails anyway.
>
> You should rather check for the "Authorization" request header.

Assuming this is also the case in Chrome, we should change the
spec to make it easier for implementers.

/cc @metromoxie