[httpapi] AD Review: <draft-ietf-httpapi-privacy-03.txt> targeting publication as a BCP

[Gorry Fairhurst <[e-mail]>]

I have reviewed draft-ietf-httpapi-privacy with a view to publication as 
a BCP.

My AD comments primarilly relate to the use of RFC-2119 keywords and 
seeking only clarifcation. I do not expect this will be difficult and 
look forward to a new revision:

(1)
NiT: "Some deployments may not find it feasible to completely block 
unencrypted connections".
- This is obvioulsy lower case, but since there is a very similar later 
sentence that specifies a RFC2119 keyword to explain something else, I'd 
suggest to chnage /may not/might not/
... especially since "may not" can be misread easily across the wider 
English-speaking community.

(2)

RFC-2119: The recommendations in 3.1 provide two clauses that use 
"SHOULD", and do clarify what is intended, thanks. However, they do not 
currently describe the sort of risk(s) when the recommendation is not 
followed - which I'd expect in a BCP.

Please provide a sentence that explains this for each clause.

(3)

REF: Please could you a reference for the "Authorization header".

---

Best wishes,

Gorry

(Responsible AD for this draft since M Bishop has recused)