Re: draft-ietf-httpapi-privacy-02 early Httpdir review

Thanks for the review.


  *
 It's hard to see why
  *
this document doesn't have a stronger requirement for encryption in general,

I don’t think we should expand the scope to become a general explanation of why encryption is good for you.  As it stands now, even parties that are unenthusiastic about an IETF goal to “encrypt the world” have to recognize that the rationale here — not doing so enables identity theft — is inarguable.


  *
  "This pattern is so well established that many HTTP server and

   intermediary implementations have a prominently displayed option to
   enable it automatically.”


  *
It might be good to add that it's so advantageous that browsers are considering
switching to HTTPS by default, and extensions like HTTPS Everywhere exist.

Again this seems like broadening the scope.


  *
- In the Introduction, s/API/HTTP API/

Fixed


  *
- "Servers with authenticated endpoints SHOULD employ both mechanisms.” ->

"HTTP API servers with..." (probably elsewhere too)

Yeah, fixed about a half-dozen other instances.

> - "The
   client's initial request may include a Bearer token or other
   credential" - Probably good to list Cookies in there too.

done.