more fixes and detail to the OIDCUnAuthAction <expr> parameter
#OIDCOutgoingProxy <host>[:<port>]
# Defines the action to be taken when an unauthenticated request is made.
+#
# "auth" means that the user is redirected to the OpenID Connect Provider or Discovery page.
# "401" means that HTTP 401 Unauthorized is returned.
# "407" means that HTTP 407 Proxy Authentication Required is returned
# "410" means that HTTP 410 Gone is returned
# "pass" means that an unauthenticated request will pass but claims will still be passed when a user happens to be authenticated already
+#
# Useful in Location/Directory/Proxy path contexts that serve AJAX/Javascript calls and for "anonymous access"
#
-# When not defined the default is "auth" with auto-detection of XML HTTP requests, returning "401".
+# When not defined the default is "auth" with auto-detection of XML HTTP requests, which would get "401".
# The default auto-detection algorithm looks for the "X-Requested-With: XMLHttpRequest" header/value,
# and/or the absence of "Accept" header with any of the values "text/html" "application/xhtml+xml" or "*/*"
+# and returns 401 for such non-browser/non-html clients. See: https://github.com/zmartzone/mod_auth_openidc/wiki/Cookies#tldr
#
# Since verson 2.4.4 a boolean Apache expression as the second parameter to specify which requests
# need to match to return the configured value in the first parameter to override the default "auth".
# See also: https://httpd.apache.org/docs/2.4/expr.html.
# E.g.:
# OIDCUnAuthAction 401 "%{HTTP_USER_AGENT} =~ /curl/"
-# to return 401 for cURL based user agents and "auth" for any other brwsers/user agents.
+# to return 401 for cURL based user agents and "auth" for any other browsers/user agents.
# OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest'"
# to effectively override the default XML request detection algorithm by ignoring the Accept headers
# OIDCUnAuthAction 401 "%{HTTP_ACCEPT} !~ m#text/html#"
# OIDCUnAuthAction 401 "%{HTTP:X-Requested-With} == 'XMLHttpRequest' || ( ( %{HTTP_ACCEPT} !~ m#text/html# ) && ( %{HTTP_ACCEPT} !~ m#application/xhtml\+xml# ) && ( %{HTTP_ACCEPT} !~ m#\*/\*# ) )"
# just as a more complex example, it equals the default XML request detection algorithm
# OIDCUnAuthAction auth true
-# To distable auto-detection of XML HTTP request altogether and uncondtionally return "auth" for all clients.
-# Note that actually any expression value in "OIDCUnAuthAction auth <expr>" will always render "auth"
-# because of the default (even when set to "false"...), so using an <expr> only makes sense in
-# combination with one of the other 401/407/410/pass values.
+# To disable auto-detection of XML HTTP request altogether and uncondtionally return "auth" for all clients.
+# Note that actually *any* expression value in "OIDCUnAuthAction auth <expr>" will *always* render "auth"
+# (even when set to "false"...) because of the default, so using an <expr> value (other than "true") only
+# makes sense in combination with one of the values other than "auth".
#OIDCUnAuthAction [auth|pass|401|407|410] [<expr>]
# Defines the action to be taken when an unauthorized request is made i.e. the user is authenticated but
