8d187b272d
Instead of a cryptic exception, let the user know if the HTTP target isn't actually asking for WWW-Authenticate. There are likely many more opportunities to catch errors, but this is the most obvious.