William, "Authorization-Results" should be "Authentication-Results" in note (13).
Though this "authentication-results" is really providing results of authorization and is not strong enough to be called authentication ....
-- William Leibzon Elan Networks william@xxxxxxxx