adding an explicit note that integrity verification stops at an iframe's document source, and will not include its subresources. fixes #9
changed wording, according to the comments
Merge pull request #11 from w3c/frame-integrity

adding an explicit note that integrity verification stops at an iframe's document source