[w3c/payment-request] Document privacy and security mitigations (#675)

As part of the CR process and through implementation/deployment, we've learned quite a bit about abuse cases. We should make sure we properly document all mitigations we've put in place without being hand-wavy - in the Privacy and Security section. 

- [ ]  use of SecureContext
- [ ]  the `allowpaymentrequest` attribute on iframe 
- [ ]  `canMakePayment()` and throttling
- [ ]  requiring user action on `show()`

And so on... please add more to the above... those are just the ones off the top of my head. 


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/issues/675