Added info on permissions model

Includes how long permissions last, restriction of stored permissions to HTTPS.
Change this to say MUST not store if page is not secure. Remove the part that section is non normative.