add another note re 'Privileged Applications Extensions' spec