update the spec to say that you must refuse inbound relay_early cells