FHIR-52960 - Require support for GET and POST at authorization endpoint

[JohnMoehrke]

This change makes the IG explicit that Authorization Servers must support both GET and POST requests to the authorization endpoint for the authorization code flow, and that clients must be prepared to use either method.

FHIR-52960

[lcmaas]

Changes already committed to main branch; looks like we were working on this at the same time.

[JohnMoehrke]

I do not see this change applied to main.

[JohnMoehrke]

I see you added POST, but you put it in a section only for authorization code flow. That is not the section the jira ticket agreed to update

[lcmaas]

This is where it best flowed with the other content. If you think this is outside of my editorial discretion, I would like to reopen the ticket. Let me know if this is necessary. The GET/POST requirement applies for authorization code flow in general. It is unrelated to the 'state' parameter so that section was not the appropriate place to insert it.

[lcmaas]

I have created a new ticket as a technical correction FHIR-58224 to fix this.

[JohnMoehrke]

to be clear... I am not at all questioning your skills and SME. I am just pointing out that the Jira ticket placed the text elsewhere... and where you placed it is limited to authorization code flow (I don't know if that is sufficient). So, I just pushed back to be clear that the change you made was not the one agreed to.