Address validation is stateless reject

We already have enough text on how to tell a client to go away and come back.
But we don't really say how a server might do that statelessly.  Add a small
bit of text on that and we're done.

Closes #60

draft-ietf-quic-tls.md

@@ -1127,6 +1127,10 @@ validation was not requested originally.  In such cases, the cookie extension
 could either be absent or it could indicate that an address validation token is
 not present.
 
+A server can use the cookie extension to store all state necessary to continue
+the connection.  This allows a server to avoid committing state for clients that
+have unvalidated source addresses.
+
 
 ## NewSessionTicket Address Validation