2.1.0
Fixed various error responses to be more accurate to spec, per RFC 6570 §3.1:
- Invalid requests should be 400 Bad Request errors, not 401 Unauthorized.
- When sending the
WWW-Authenticate
header in response to invalid requests or invalid tokens, the appropriate error code and description can be included in that header.