Hi Maxim,

sure it is! But if the time between 2 requests for authentication too large is a 408 code should be thrown.

When this code is issued, it should not be Returned with code 200, but that happened here.

Otherwise, the client does not understand what's going on. Sure, we could also have a code 503, but based on the "edit log" is a code 408 is required.

Other webservers do response also the code 408 and a body.