Improve security & privacy guidance

This is a first attempt at listing some of the threats and
potential mitigations for this API.  It does not cover
user interaction guidelines, and is a bit vague about the
mitigations.  It also does not really consider privacy in
much depth.

Issue #26
HTML5 Tidy of security section.
Merge pull request #139 from jplyle/improve-security-section

Improve security and privacy section