Use response_mode=cookie in example for "5.2 Unauthenticated Requests"

[johakoch]

Hi @jaredhanson

This is about https://datatracker.ietf.org/doc/draft-hanson-oauth-cookie-response-mode/ (which apparently is a more recent version of the document in this repo).

In section "5.2. Unauthenticated Requests" you give an example how a protected resource may respond to an unauthenticated request by

• setting the WWW-Authenticate response header field with Thomas Broyer's Cookie auth scheme and
• setting an HTML login form as the response body content.

To me it would seem more appropriate to give an example where the response contains a redirect to the authorization endpoint using the response_mode=cookie that this spec defines.

See also aaronpk/draft-hanson-oauth-cookie-response-mode#2