Clarify what to hash

See thread at
http://lists.w3.org/Archives/Public/public-webappsec/2014Apr/0018.html