I would appreciate if the spec explicitly stated that requests using this scheme are neither value carrying nor authorizations. It would avoid so much hassle if they clearly stepped back from any appearance that this is a money transmission mechanism.
