Review and changes from Jocelyn Fiat

I don't know if the Authentication Info header is mandatory .. and if we should send it only when the auth is successful or not.