Use of protected and unprotected headers

[veselov]

Hello.

So far, CJose only supports "protected" headers. This is true for both JWS and JWE, but I'd like to focus on JWE only for now.
To support multiple recipients, however, unprotected headers are necessary.
I can't find any clear guidelines on which keys can be in either protected or unprotected headers. There are some examples, but they seem to be non-binding.
So, for using the header values, for building up the keys and such, I believe I need to provide all of the 3 headers:

1. protected header
2. shared unprotected header
3. per (current) recipient unprotected header

So, for example, the code that determines the key algorithms, encryption algorithm, and etc., need to get the information it needs. I'm a also a bit puzzled on the order. Looks like "protected" header should be the first choice (because it's protected) before falling back onto the unprotected ones, but that doesn't make sense, because per recipient obviously has higher specificity.

To recap:

1. Are there any rules on which key properties should be in which types of headers
2. What should be the order of probing for a property among various headers

Thank you.