Mention cross-protocol attacks

[letitz]

@martinthomson has a point in w3ctag/design-reviews#572 (comment):

This proposal is no substitute for services providing encryption and proper access controls. This proposal does not protect adequately against true cross-protocol attacks that use either unencrypted HTTP or attacker-controlled components of TLS handshakes to attack poorly-protected servers from the vantage point of a client (we have a port number blocklist that is designed to help, but we know that too is not perfect).

This is largely true. Cross-protocol attacks would get harder because the request initiator would be constrained by the format of CORS preflight requests, but this is not intended to provide a robust protection in this case, nor would it. TLS handshakes are entirely unaffected.

We should call this out more clearly in the spec.