Use Authorization "Bearer".

That's what OAuth2 does.
Make unauthorized requests return a WWW-Authenticate header.

This is what OAuth tells us to do.
Changed error codes.

I was mirroring the HTTP response code but that is pointless
duplication.  Now we only have 0 (No-error) and 1 (General error).  We
can add meaningful codes if they are useful.