title: HTTP 401 - what's an appropriate WWW-Authenticate header value?
body: <p>The application I'm working on at the moment has a session timeout value. If the user hasn't interacted for longer than this value, the next page they try to load, they will be prompted to log in.</p>
  
  <p>All requests made are routed through this mechanism, which includes AJAX calls. Originally we were sending a 200 header with the login page, which introduces some problems with AJAX since code is run if a 200 response is sent, and most data sent back from these RPC calls is JSON or raw JavaScript that gets evaluated (don't ask :|).</p>
  
  <p>I've suggested that a 401 is better, since our JSON parser won't try to consume an HTML login page.. :)</p>
  
  <p>When <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2" rel="noreferrer">reading the spec</a>, however, I noticed that the <strong><code>WWW-Authenticate</code></strong> field must also be sent.</p>
  
  <p>What is a good value for this field? Will <code>Application Login</code> suffice?</p>