tomchristie/django-rest-framework — pull request #1021 by kreichgauer (2013-08-01 11:48:37+00:00)
Title: Make TokenAuthentication RFC2617 compliant

RFC2617[0] requires that the scheme in the WWW-Authenticate header is `followed by a comma-separated list of attribute-value pairs which carry the parameters necessary for achieving authentication via that scheme.`. That list must not be empty: `challenge = auth-scheme 1*SP 1#auth-param`.

[0] http://tools.ietf.org/html/rfc2617#section-1.2