Does Godot 4's HTTPClient enforce token expiry or scope checks on its own?

Godot 4's high-level HTTP classes, HTTPClient and HTTPRequest, accept arbitrary headers for each request, but the engine ships no built-in OAuth2, JWT, or session-token library. Authorization values appear to be treated as opaque strings: the documented API describes no automatic expiry validation, scope checking, or least-privilege enforcement before a request is transmitted.

That leaves an unresolved design question for projects that call REST backends with short-lived access tokens and scoped permissions. Scattering expiry checks across every call site invites inconsistency, while a centralized wrapper is a layer the engine does not provide. Whether core networking should eventually grow a standardized auth middleware also appears undecided.

1. Does HTTPClient or HTTPRequest in Godot 4.x perform any automatic validation of Authorization tokens, such as expiry timestamps or scope claims, before sending?
2. If validation is entirely application-side, what is the recommended way to centralize token refresh and least-privilege checks in GDScript without modifying engine source?
3. Is any auth middleware for the core networking stack on an accepted roadmap, or is this expected to remain a per-project concern?