Should probably talk about public user identities rather than aor or URIs here - when we add support for P-Assert-Identity/P-Preferred-Identity/P-Associated-IDs headers this will read better.