Changed return status for CSRF failures to HTTP 403

By default, Django returns "HTTP 403 Forbidden" responses when CSRF
validation failed[1]. CSRF is a case of authorization, not of
authentication. Therefore `PermissionDenied` should be raised instead
of `AuthenticationFailed`.

[1] https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#rejected-requests
Determine WWW-Authenticate header using all authentication classes

When trying to determine the WWW-Authenticate header, previously the
first available authentication class was used. If it didn't provide any
header (see the `SessionAuthentication` class as an example), `None` was
returned, even though there might be another authentication class which
does provide a valid header.

With this commit, the code that tries to determine the
WWW-Authentication header iterates through all available authentication
classes, until it finds one that provides a valid header (if any).