Add sentence warning about sensitive content in unauthorized resource requests

[LudwigSeitz]

As per Steffi's review we should put a sentence in the draft that warns from sending sensitive data in the initial unauthorized resource request.