I'll let @jpinner give the advice, as it is more about secure practice than what the spec allows.