Use RFC words in the Security and Privacy sections.
Integrate more/updated text from the Security sections of other specifications.

Some of these changes are based on review of:
* Indexed Database API: W3C Proposed Recommendation 20 November 2014 (http://www.w3.org/TR/2014/PR-IndexedDB-20141120/)
* Web Storage: Editor's Draft 14 May 2014 (http://dev.w3.org/html5/webstorage/)
Make most of the Security section normative.
Make most of the Privacy section normative.
Bug 27165 - User agents should warn users if they bring along unclearable identifiers
Bug 27269 - Normatively require distinctive identifiers to be different by EME-using origin.