Update dnt-policy-discussion-draft.txt

User identifiers must be used to authenticate a logged in user so it makes no sense to remove them in that case. I changed Paragraph 1 (End User Identifiers) to only cover identifiers NOT used for authentication, and added a sentence to say authentication UIDs would only be retained up to 2 hours after the last request, i.e. after 2 hours no activity they are logged out. 2 hours seems reasonable to me, others might disagree.