Merge pull request #444 from w3c/fullscreen_displaymode

Feat(displaymodes): add priv/sec note (closes #402)

index.html

@@ -542,6 +542,29 @@ <h2>
         <code>document.fullScreenElement</code> returns <code>null</code>, and
         <code>fullscreenEnabled</code> returns <code>false</code>.
       </p>
+      <section>
+        <h3>
+          Privacy and security considerations
+        </h3>
+        <p>
+          When the <a>fullscreen</a> <a>display mode</a> is applied, it is
+          RECOMMENDED that the user agent provides the end-user a means to
+          consult common information about the web application, such as the
+          origin, start and/or current URL, granted permissions, and associated
+          icon. How such information is exposed to end-users is left up to
+          implementers.
+        </p>
+        <p>
+          Additionally, when applying a manifest that sets the <a>display
+          mode</a> to anything except "<a>browser</a>", it is RECOMMENDED that
+          the user agent clearly indicate to the end-user that their are
+          leaving the normal browsing context of a web browser. Ideally,
+          launching or switching to a web application is performed in a manner
+          that is consistent with launching or switching to other applications
+          in the host platform. For example, a long and obvious animated
+          transition, or speaking the text "Launching application X".
+        </p>
+      </section>
       <section>
         <h3>
           The <code>'display-mode'</code> media feature