Section 1.2 shows:
credentials = auth-scheme #auth-param
Shouldn't that more correctly be
credentials = auth-scheme 1#auth-param
It's hard for me to imagine an auth-scheme that can work correctly
and usefully with zero auth-param's in the credentials.
Dave Kristol