checked

I'm leery about making any claims that these profiles will somehow allow clients to always know exactly what credentials (beyond token type) are 
required for "effective usage".

However, the premise is to advertise token requirements that may have use beyond secure communication (e.g., authZ).    I've changed the sentence to 
remove the communication-specific qualifier for tokens, and it now reads:

"As specified, the endpoint reference does not provide a normative approach for advertising any service-specific secure communication requirements or 
the security tokens that would be needed by a client."