Issue 4: Security

[Terry Allen <tallen@sonic.net>]

note there's no requirement to publish your security policy.

"Security of some sort is required for all functions of the 
registry and repository, and so should not be considered 
separately. Security should be sufficient to engender 
confidence in the registry and repository."