Token encryption cannot replace TLS. See #64

[ioggstream]

This PR

• token encryption can't replace TLS unless similar requirements are implemented (integrity, privacy, authenticity) ;
• suggest using TLS along the way, even when using TLS terminators;
• MUST does not define here a specific requirement

Note

Some mitigation measure express strict requirements (e.g. MUST NIT store in insecure cookies). IMHO that's ok, but in this case it's more than mitigation, since an implementation that does not respect these is non conformant.