Original text:
3. <del> Some captive portal network deployments may be unable to change, or unwilling to risk changing, the network infrastructure necessary to use any of the above options.  In such deployments, when clear text HTTP intercept and redirection are used, a Link relation header (RFC8288, Section 3.3) MAY be inserted to convey to a HTTP client (user agent) the associated Captive Portal API URI. HTTP user agents MUST ignore this link relation in any context other than when explicitly probing to detect the presence of a captive portal.  Failure to do so could allow an attacker to inject a Captive Portal API URI other than the correct URI for a given network or for networks where there is no captive portal present at all. 4. </del> A device may learn about Captive Portal API URIs through more than one of (or indeed all of) the above options.  It is a network configuration error if the learned URIs are not all identical. captive device MUST prioritize URIs learned from network provisioning or configuration mechanisms before all other URIs.  Specifically, URIs learned via any of the options in option should take precedence <del> over any URI learned via a mechanism like the one described in linkrel. </del>  If the URIs learned via more than one option described in option are not all identical, this condition should be logged for the device owner or administrator.  URI precedence in this situation is not specified by this document. <del> 5. </del>  This document requests two new IETF URN protocol parameter (RFC3553) entries. Thanks IANA! <del> 5.1. </del>  <del> 5.1.1. </del>  Registry name: Captive Portal Unrestricted Identifier Index value: Only one value is defined (see URN above).  No hierarchy is defined and therefore no sub-namespace registrations are possible. <del> 5.1.2. Registry name: Captive Portal API Link Relation Type URN: urn:ietf:params:capport-api Specification: RFC TBD (this document) Repository: RFC TBD (this document) Index value: Only one value is defined (see URN above).  No hierarchy is defined and therefore no sub-namespace registrations are possible. 6. </del>  <del> An attacker with the ability to inject DHCP messages, RAs, or HTTP headers into cleartext HTTP communications could include an option or link relation from this document and so force users to contact an </del>  address of his choosing.  As an attacker with this capability could simply list himself as the default gateway (and so intercept all the victim's traffic); this does not provide them with significantly more

Reviewer comments:
At IETF 106, we discussed removing the link relation. This PR does that.
I suppose we should be reading and implementing draft-ietf-git-github-wg-configuration ... As Warren's T-shirt says: "In my defense I was left unsupervised."
100% agreed about the build output...
People who put build output in their repository deserve a special place.

Revised text:
3.  A device may learn about Captive Portal API URIs through more than one of (or indeed all of) the above options.  It is a network configuration error if the learned URIs are not all identical. captive device MUST prioritize URIs learned from network provisioning or configuration mechanisms before all other URIs.  Specifically, URIs learned via any of the options in option should take precedence  <ins> over any URI learned via some other mechanism, such as a redirect. </ins> If the URIs learned via more than one option described in option are not all identical, this condition should be logged for the device owner or administrator.  URI precedence in this situation is not specified by this document.  <ins> 4. </ins> This document requests two new IETF URN protocol parameter (RFC3553) entries. Thanks IANA!  <ins> 4.1. </ins>  <ins> 4.1.1. </ins> Registry name: Captive Portal Unrestricted Identifier Index value: Only one value is defined (see URN above).  No hierarchy is defined and therefore no sub-namespace registrations are possible.  <ins> 5. </ins>  <ins> An attacker with the ability to inject DHCP messages or RAs could include an option from this document to force users to contact an </ins> address of his choosing.  As an attacker with this capability could simply list himself as the default gateway (and so intercept all the victim's traffic); this does not provide them with significantly more