Send a WWW-Authenticate header when the response code is 401

Since, the default Unauthorized function does not send WWW-Authentication header when the status code is 401, it doesn't work with some http clients. Requesting you to look into this.

For reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401

I can create a PR if you think this should be a default.

Thanks.