Added Security considerations

Added first draft of security considerations for discussion. Also,
uncommented-out a section in the IANA considerations that made xml2rfc
crazy due to double-hyphens in a comment.