XEP-0363: clients SHOULD NOT interpret headers

Signed-off-by: Maxime “pep” Buquet <pep@bouah.net>

xep-0363.xml

@@ -343,6 +343,7 @@ Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT
 Access-Control-Allow-Headers: Authorization, Content-Type
 Access-Control-Allow-Credentials: true
 ]]></code>
+  <p>Clients SHOULD NOT interpret headers and treat them as opaque.</p>
 </section1>
 <section1 topic='Security Considerations' anchor='security'>
   <section2 topic="Server side" anchor="server">