Hi,

> no sorry, i used the word constant wrong. i meant use a special value that is not a string, but for instance a number, or false, or undefined. that way it's outside the namespace of normal token values.

Agreed, that’s better.  It also feels like blasphemy to use dynamic typing like that… I tried null of course, but it wasn’t distinguishable from not-having-set-to-a-value-yet.  Perhaps having a flag that signals the implied mode is better?

> in any case, i would only activate this feature if the server explicitly announces support for it. so only for -03 servers, and only if we end up adding the feature to the spec.

I am very much in line with that — to explicitly announce an authentication/authorisation mechanism.  Let me know if you would like textua input on -03 about this, or if you’d like me to read it in an attempt to keep it as general as can be.  There are many mechanisms in the pipeline worth taking into account — SAML, SRP, OpenPGP can all work over TLS.

-Rick