Per spec, a 401 Unauthorized response [must send a WWW-Authenticate challenge header](http://tools.ietf.org/html/rfc7235#section-3.1). Should it be modified to take a list of `werkzeug.datastructure.WWWAuthenticate` and serialise them to headers in get_headers?