title: Proper WWW-Authenticate header for OAuth provider
body: <p>In the <a href="https://datatracker.ietf.org/doc/html/draft-hammer-oauth-10" rel="nofollow noreferrer">OAuth 1.0 spec</a> it is suggested to respond with the following WWW-Authenticate header:</p>
  <pre><code>WWW-Authenticate: OAuth realm=&quot;http://server.example.com/&quot;
  </code></pre>
  <p>Is it suitable to add any other informative data to this header? In case a request for a protected resource fails, would it be reasonable to include some information as to why? Such as:</p>
  <pre><code>WWW-Authenticate: OAuth realm=&quot;http://server.example.com/&quot;, access token invalid
  </code></pre>
  <p>Or is this contrary to the purpose of the response header?</p>