Security and privacy considerations

[anssiko]

Per https://www.w3.org/TR/security-privacy-questionnaire/#considerations we should add a Security and privacy considerations section to the spec.

[anssiko]

So that we remember, PING review feedback to be incorporated in the Security and privacy considerations:

As I understand it, the API operates on the client-side only. This feature might be worth mentioning in the privacy considerations.