Added notes based on feedback from initial dicussion on public-webappsec mailing list.