show() must be triggered by user activation

closes #651

Author: marcoscaceres

index.html

@@ -839,6 +839,10 @@ 
           MUST act as follows:
         p>
         <ol class="algorithm">
+          <li>If the method was not <a>triggered by user activationa>, return
+          a promise rejected with a "<a>SecurityErrora>" <a>DOMExceptiona>
+          and terminate this algorithm.
+          li>
           <li>Let <var>requestvar> be the <a>PaymentRequesta> object on
           which the method is called.
           li>
@@ -856,19 +860,9 @@ 
               Optionally, if the <a>user agenta> wishes to disallow the call
               to <a>show()a> to protect the user, then return a promise
               rejected with a "<a>SecurityErrora>" <a>DOMExceptiona>. For
-              example, the <a>user agenta> may require the call to be
-              <a>triggered by user activationa>, or may limit the rate at
-              which a page can call <a>show()a>.
-            p>
-            <p class="note">
-              During the Candidate Recommendation phase, implementations are
-              expected to experiment in this area. Developers using this API
-              should investigate and anticipate such experiments and understand
-              under what circumstances a "<a>SecurityErrora>"
-              <a>DOMExceptiona> might occur. If interoperable behavior
-              emerges amongst user agents, then that behavior will be
-              standardized here before progressing the specification along the
-              W3C Recommendation Track.
+              example, the <a>user agenta> may limit the rate at which a page
+              can call <a>show()a>, as described in the <a href=
+              "#privacy">privacy considerationsa> section.
             p>
           li>
           <li>If <var>requestvar>.<a>[[\state]]a> is not "<a>createda>"