Expose WWW-Authenticate headers

Should fix #10.
Since we now whitelist the properties being exposed on the body, I'm fine with keeping the headers. It may be useful for other purposes later on.