Always add auth URI to unauthorized requests

For those services that use delay_auth_decision we need to support
adding the keystone URI rejection headers to the response in a uniform
way. I feel this should be more generic and that every 401 response
should contain this header.

Create a WSGI wrapper so that if a 401 is ever returned through
auth_token middleware we can add an additional WWW-Authenticate header.

Closes-Bug: #1349364
Change-Id: Ib5231a09fd5c6cb6cd17f07c87e982d2e8fde2bf
Merge "Always add auth URI to unauthorized requests"