If you strip off the TLS, you *still* cannot pass messages around without protecting them as if they had secrets because, well, the header name you are using is secret. This is not a defense in depth.
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
