code: @Override
      protected String makeChallengeString(ResourceAddress address, HttpRealmInfo realm, Object... params) {
          StringBuilder sb = new StringBuilder();
          String challengeScheme = realm.getChallengeScheme();
  
          if (isApplication(challengeScheme)) {
              sb.append(AUTH_SCHEME_APPLICATION_PREFIX);
          }
  
          sb.append(getAuthenticationScheme());
  
          if (params != null) {
              // Don't forget the additional parameters (KG-2191)
              for (Object obj : params) {
                  sb.append(" ").append(obj);
              }
          }
  
          return sb.toString();
      }
docs: /* Override the HttpChallengeFactoryAdapter makeChallengeString method,
  since that method automatically adds the "realm=" challenge parameter,
  and for the suis generis "Application Token" authentication scheme --
  explicitly designed to be opaque -- we want to stay out of the way
  of the custom opaque tokens.