including RFC 5261's security considerations by reference