[access-control] Security Considerations

The currently written text appears normative, but that is misleading  
since such sections are usually informative. Pre-flight request  
results are also stored to disk and so, it is a good idea to either  
add something to the Security Considerations or deal with it in the  
rest of the spec.

Nikunj