Security Considerations on Client authentication

[PieterKas]

As discussed at IETF 121

Add security considerations outlining the importance of using client authentication when using the Access Token (sender constrained, or as bearer token) as Subject Token. Points to cover include:

1. Implications of a stolen access token - mitigated by client authentication
2. Limitations on preserving the binding (key is not under control of the entity requesting an assertion)