Lots

Added security considerations, cross-domain authentication use case.
Removed normative language throughout (I think we should wordsmith that
after getting buy in on the concepts. Added additional references in
recommendations sections. Lots of editorial edits.