Contents of follow-in continue response

[jricher]

§5.2 Continuing During Pending Interaction: Editor's note:

Do we want to be more precise about what's expected inside the "continue" object? I think that at least the URI is required, access token required IF used, etc. This is even if they haven't changed since last time, and the client will use whatever value comes back?

[jricher]

Yes, we should be explicit about what's in here every time, and that it should always be included (so a client can rely on it always being there and always using the newest value). No good argument to optimize by omission, since that leads to lazy clients not checking the return values. One quirk: access token value; some servers never see the access token's value after they issue it (they store the hash or other derived reference), and so returning the same value if they want to re-use it is a pain. However, these servers can always rotate the continuation access token, which is recommended (#87) so this point might be moot.