buddy.auth.backends.token/handle-unauthorized-default violates RFC 7235 section 4.1. WWW-Authenticate

[sorsasampo]

RFC 7235 section 4.1. WWW-Authenticate specifies:

A server generating a 401 (Unauthorized) response MUST send a WWW-Authenticate header field containing at least one challenge.

However, buddy.auth.backends.token/handle-unauthorized-default sends a 401 status response without a WWW-Authenticate header:

buddy-auth/src/buddy/auth/backends/token.clj

Lines 22 to 27 in 36a02a4

	(defn- handle-unauthorized-default
	"A default response constructor for an unauthorized request."
	[request]
	(if (authenticated? request)
	{:status 403 :headers {} :body "Permission denied"}
	{:status 401 :headers {} :body "Unauthorized"}))