FirstOf<T> class final

Tries each extractor in order and takes the first that succeeds.

How one endpoint serves a browser session and a machine key at once:

const signedIn = FirstOf([SessionScheme(), ApiKeyScheme()]);

When every scheme declines for want of a credential, the refusal names all of them: HTTP allows several challenges in one response, and a 401 offering only the last scheme tried tells a browser to do the wrong thing.

WWW-Authenticate: Bearer, Basic realm="api", Cookie

A challenge carrying its own parameters — Basic realm="api", charset="UTF-8" — already contains a comma, and the joined header stays unambiguous anyway: an auth-param contains = and a scheme name does not, so a parser attaches the parameter to the scheme before it.

A refusal that is not a 401 wins over that, because it is more specific: a 403 means a credential was presented and was not good enough, and burying it under "no credentials" sends the caller looking for the wrong problem.

A 5xx from any extractor stops the search immediately: that means something on the server is broken, and trying the next scheme would turn a fault into a confusing 401.