This is fine by me.
It only leaves the question of which options are mandatory-to-implement, so
that independently developed implementations will always be able to
interoperate.
>
> The SERVER controls the type of authorization, not the client, so you
> won't have the opportunity to "downgrade" to a lower level of
> security.
> The server says, "my way or the highway"...
True, but so does the client. It can (and should be able to be) configured
with the lowest level of security it will accept, and if the server only
offers less secure protocols than that, it refuses to connect.
BTW: there is advantage to running Digest (instead of Basic), even with the
weakest options, inside of TLS. Basic exposes your password to the server,
whereas Digest server can store hashes of passwords that are realm specific,
and so use of the same password in multiple realms isn't as big an exposure.
Paul