Additional WWW-Authenticate Response Information

[danielshiplett]

The Problem

We recently had an application request fail to provide any bearer token in the Authorization header. They received a 401 as expected. However, the www-authenticate response header only had the word Bearer in the value. This made it difficult to debug as it implied that they were sending a bearer token when they weren't.

The Request

I suggest an improvement in Spring Security to add an error message such as missing_token or some other similar value to help identify the root problem.

This PR contains a test case that will pass when the additional error message is provided.

I am willing to provide a fix for this as well. However, I don't know where in Spring Security to implement such a fix. I know about BearerTokenAuthenticationEntryPoint where other bearer token related errors have their details added. However, that doesn't feel right in this case because we aren't 100% guaranteed the intent of the request was to provide a bearer token (some other form of Authorization may be supported along with OAuth2 Resource Server).

[jzheaux]

Closed in favor of #16976