@kopper @hazelnoot @erincandescent the exact method doesnt matter as long as both sides agree on it

it's just that none of the methods are currently fully defined or negotiable, everyone just assumes everyone else supports the exact same scheme

and they do have some different qualities. an authorization token doesnt imply any authentication, for example, but a signed statement that you are authenticating as a certain identity clearly does