Spec WWW-Authenticate and Proxy-Authenticate handling in HTTP-network-or-cache fetch

[gmta]

What is the issue with the Fetch Standard?

The current HTTP-network-or-cache fetch specification leaves checking the WWW-Authenticate header open for interpretation; ignoring it might trigger an infinite HTTP 401 loop re-asking a username and password to send with the new requests:

fetch/fetch.bs

Lines 5873 to 5874 in 4cb3cf2

	<li class=XXX><p>Needs testing: multiple `<code>WWW-Authenticate</code>` headers, missing,
	parsing issues.

Similarly, HTTP 407 handling has outstanding Proxy-Authenticate header handling that needs to be specced:

fetch/fetch.bs

Lines 5918 to 5919 in 4cb3cf2

	<li class=XXX><p>Needs testing: multiple `<code>Proxy-Authenticate</code>` headers, missing,
	parsing issues.