add comment about www-authenticate

Author: pcarleton

src/scenarios/client/auth/basic-metadata-var1.ts

@@ -29,6 +29,12 @@ export class AuthBasicMetadataVar1Scenario implements Scenario {
       () => this.baseUrl,
       () => this.authBaseUrl,
       {
+        // TODO: this will put this path in the WWW-Authenticate header
+        // but RFC 9728 states that in that case, the resource in the PRM
+        // must match the URL used to make the request to the resource server.
+        // We'll need to establish an opinion on whether that means the
+        // URL for the metadata fetch, or the URL for the MCP endpoint,
+        // or more generally what are the valid scenarios / combos.
         prmPath: '/.well-known/oauth-protected-resource'
       }
     );