Fix the www-authenticate header parsing logic

[lbalmaceda]

Changes

The header object is a special list that must be accessed with get(name), otherwise, there are certain cors scenarios where not all the headers would be exposed.

This PR handles the possibility of that header not being set and ensures the last fallback is also test-covered.

References

#285 introduced a change that wasn't properly tested

Testing

• This change adds unit test coverage
• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines
• All existing and new tests complete without errors
• All active GitHub checks have passed

[nicosabena]

Awesome, thanks Luciano!