Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
Yes.  The authn provider should populate WWW-Authenticate but for the majority of calls I would prefer we define that the server will only challenge Bearer but clients must be flexible to receiving other types, in which case they are allowed to treat the reauth as "non actionable".  What that allows is SSL client auth and Kerb proxies to sit in front of bearer auth and offer an additional level of control.