The spec is now very explicit about auth:

Servers MUST reject requests with invalid or missing authentication credentials

Should this be a part of the specification? Authentication is very application specific.
Can we say that an SDK is protocol compliant if it provides a way to set an interceptor which can potentially verify authentication?
What does it mean for a credential to be invalid?
What if I want to handle auth on another layer in the internal deployment cross-service integration?