code: def make_error_response(self, validation_error, expose_errors):
      
      authenticate_header = ['Bearer realm="{}"'.format(settings.DJOAUTH2_REALM)]
  
      if not expose_errors:
        response = HttpResponse(status=400)
        response['WWW-Authenticate'] = ', '.join(authenticate_header)
        return response
  
      status_code = 401
      error_details = get_error_details(validation_error)
  
      if isinstance(validation_error, InvalidRequest):
        status_code = 400
      elif isinstance(validation_error, InvalidToken):
        status_code = 401
      elif isinstance(validation_error, InsufficientScope):
        error_details['scope'] = ' '.join(self.required_scope_names)
        status_code = 403
  
      # TODO(peter): should we return response details as JSON? This is not
      # touched upon by the spec and may limit use of this library.  Many
      # programmers use other transport languaes such as YAML or XML. All of the
      # error information is already included in the headers.
      response = HttpResponse(content=json.dumps(error_details),
                              content_type='application/json',
                              status=status_code)
  
      for key, value in error_details.iteritems():
        authenticate_header.append('{}="{}"'.format(key, value))
  
      response['WWW-Authenticate'] = ', '.join(authenticate_header)
      return response
docs: Return an appropriate ``HttpResponse`` on authentication failure.
  
      In case of an error, the specification only details the inclusion of the
      ``WWW-Authenticate`` header. Additionally, when allowed by the
      specification, we respond with error details formatted in JSON in the body
      of the response. For more information, read the specification:
      http://tools.ietf.org/html/rfc6750#section-3.1 .
  
      :param validation_error: A
        :py:class:`djoauth2.access_token.AuthenticationError` raised by the
        :py:meth:`validate` method.
      :param expose_errors: A boolean describing whether or not to expose error
        information in the error response, as described by the section of the
        specification linked to above.
  
      :rtype: a Django ``HttpResponse``.