Add information about scope of policy to the Introduction

[alvestrand]

In the Introduction, the scope of a policy is left completely unclear. It's easy to read it and come to the conclusion that this stuff is about defining policies for the entire browser or browser session, akin to how a .pac file influences proxy policies.

It's clear from the later parts that this is not the intent; the policy is communicated on the response from which a Document object is initialized, and only affects objects within that Document's context (including, I assume, iframes within the Document).

This ought to be clear from the introduction.

[igrigorik]

@alvestrand ptal at the explainer doc: https://docs.google.com/document/d/1k0Ua-ZWlM_PsFCFdLMa8kaVTo32PeNZ4G7FFHqpFx4E/edit. We haven't updated the spec to match what we're discussing there (simplifying to whitelist-only model), but I believe it should address what you're raising here.

[igrigorik]

Closing, please refer to #43 for latest and greatest.