w3c/webappsec — pull request #108 by fmarier (2014-12-10 00:57:58+00:00)
Title: `Authorization` is the header likely to be seen, not `WWW-Authenticate`

During a quick review of my SRI patch for Firefox, one of the network
engineers pointed this out:

> Checking for WWW-Authenticate is a non-sense. It will never pop-up
> here. Only when credentials are not provided and the channel just
> propagates the 401 response in which case the load fails anyway.
>
> You should rather check for the "Authorization" request header.

Assuming this is also the case in Chrome, we should change the
spec to make it easier for implementers.

/cc @metromoxie