teach passport-hawk how to supply a WWW-Authenticate header.

The previous fail syntax was not helping passport understand that
there was a 401 involved. This fixes that by using the fail syntax:
`strategy.fail(challenge, status)` with values from the Boom error
passed back from Hawk. This isn't the only syntax, but it's
simple. Setting the status to 401 and challenge (usually with error,
provided by Hawk) triggers passport to return a 401 with a
WWW-Authenticate header. This also works with multiple auth methods.

Also in this commit: simplified error handling through Hawk. All
Boom-generated auth failures from Hawk are handled uniformly, and all
other errors (for now) throw a server error. TODO: inspect Hawk for
non-boom errors that should be treated as failures.