IList<string> on public APIs?

[yishaigalatzer]

https://github.com/aspnet/HttpAbstractions/blob/dev/src/Microsoft.AspNet.Http/HttpResponse.cs#L58

This code and similar related APIs expose IList where the API could be either

IEnumerable<string> or IReadOnlyList<string>

This ties to ChallengeResult in MVC and Security calls.

Should this API stay as is, or should we switch it?

[sornaks]

If we choose to fix this, we should also change - aspnet/Mvc@6b836e9

[glennc]

In general any time we can take in an IEnumerable we should do that.