No warning message when auth headers are sent to unauthenticated endpoint

[jdaigneau5]

Summary

If a client calls and unauthenticated endpoint and sends their authentication credentials, there isn't a message or indication that the credentials aren't being used. This can cause confusion and may lead a user to think their credentials are correct when they aren't.

Definition of Done

• Determine if informing users when their credentials aren't used is necessary
• Determine how to inform users (i.e. in response body, headers)

[jdaigneau5]

Dev note: Need to determine if this is desired behavior

[jdaigneau5]

AWG 8/13/24: closing based on AWG discussion