fix step-up auth to work with python too

Author: pcarleton

src/scenarios/client/auth/scope-handling.ts

@@ -347,11 +347,12 @@ export class ScopeStepUpAuthScenario implements Scenario {
 
       if (!hasRequiredScopes) {
         // Has token but insufficient scopes - return 403
+        // Per RFC 6750 Section 3, must include error in WWW-Authenticate header
         return res
           .status(403)
           .set(
             'WWW-Authenticate',
-            `Bearer scope="${requiredScopes.join(' ')}", resource_metadata="${resourceMetadataUrl()}"`
+            `Bearer error="insufficient_scope", error_description="Token has insufficient scope", scope="${requiredScopes.join(' ')}", resource_metadata="${resourceMetadataUrl()}"`
           )
           .json({
             error: 'insufficient_scope',