RE: #195, was: ABNF for Authorization header not quite right

On Wed 2011-07-27 17:45 +0700  Manger, James H <James.H.Manger@team.telstra.com> wrote:
[...]
> That is, I think a <b64> blob should only be allowed when it is the first (and only) parameter.

I agree, both for challenges and for credentials.

If some auth-scheme needs multiple base64 blobs it should use #auth-param
(i.e. key-value pairs, presumably with quoted-string values) to convey them.

I agree that NTLM, Negotiate, and even Nego2 need only a single base64 blob;
they do not need multiple base64 blobs.