Clarify which RFC is being referenced.

Author: ChetHosey

modules/oauth-internal-tokens.adoc

@@ -18,8 +18,8 @@ responses from `/oauth/authorize`, and how they should be handled:
 [cols="2a,8a,8a",options="header"]
 |===
 |Status | Content                                                                                                                                          | Client response
-|302    | `Location` header containing an `access_token` parameter in the URL fragment (link:https://tools.ietf.org/html/rfc6749#section-4.2.2[RFC 4.2.2]) | Use the `access_token` value as the OAuth token.
-|302    | `Location` header containing an `error` query parameter (link:https://tools.ietf.org/html/rfc6749#section-4.1.2.1[RFC 4.1.2.1])                  | Fail, optionally surfacing the `error` (and optional `error_description`) query values to the user.
+|302    | `Location` header containing an `access_token` parameter in the URL fragment (link:https://tools.ietf.org/html/rfc6749#section-4.2.2[RFC 6749 section 4.2.2]) | Use the `access_token` value as the OAuth token.
+|302    | `Location` header containing an `error` query parameter (link:https://tools.ietf.org/html/rfc6749#section-4.1.2.1[RFC 6749 section 4.1.2.1])                  | Fail, optionally surfacing the `error` (and optional `error_description`) query values to the user.
 |302    | Other `Location` header                                                                                                                          | Follow the redirect, and process the result using these rules.
 |401    | `WWW-Authenticate` header present                                                                                                                | Respond to challenge if type is recognized (e.g. `Basic`, `Negotiate`, etc), resubmit request, and process the result using these rules.
 |401    | `WWW-Authenticate` header missing                                                                                                                | No challenge authentication is possible. Fail and show response body (which might contain links or details on alternate methods to obtain an OAuth token).