Existing Wording: A server has ensured that every API request includes a valid Authorization token, supplied via: Authorization: Bearer

Comment:

This second requirement of the security section seems to be too specific. Binding this specific of a security requirement into US-Core will force a new IG to be written when a new security is needed. Far better US-Core set broad security requirements (such as #3), and recommend us of security IG like SMART-on-FHIR. In this way as SMART evolves those enhancements are available; or as new IG are written for specific security settings they can be used with US-Core without breaking US-Core. (See security considerations section of IHE profiles like MHD)

Summary:

Update security requirements to reference SMART on FHIR