unt&gt;
    at &lt;host&gt; and extract the &lt;storage_root&gt; and &lt;storage_api&gt;
    information.

    If no access_token was given, then the application SHOULD also
    extract the &lt;auth_endpoint&gt; information from WebFinger, and continue
    as per application-first bearer token issuance.

    Note that whereas a remoteStorage server SHOULD offer support for
    the application-first flow with WebFinger and OAuth, it MAY choose
    not to support the storage-first flow, provided that users wi