title: What should I pass for the WWW-Authenticate header on 401s if I'm only using OpenID?
body: <p>The HTTP spec states:</p>
  
  <blockquote>
    <p><strong>10.4.2 401 Unauthorized</strong></p>
    
    <p>The request requires user authentication. The response MUST include a WWW-Authenticate
    header field (section 14.47) containing a challenge applicable to the requested resource. </p>
  </blockquote>
  
  <p>If the only login scheme I support is OpenID (or CAS, or OAuth tokens, &amp;c.), what should I put in this field? That is, how do I indicate that the client needs to <em>pre-authenticate</em> and create a session rather than try to send credentials along with each request?</p>
  
  <p>Before you answer, "don't send a 401; send a 3xx redirecting to the OpenID login page," what about for non-HTML clients?  How, for example, would Stack Overflow do an API that my custom software could interact with?</p>