I've also made some changes to normative text. Specifically,
removed a MUST NOT on UI interaction, since that seems quite unnecessary and entirely untestable
replaced a SHOULD NOT with a MUST NOT on dealing with too many challenges from the origin, and tightened up the language a bit. I could not see a good reason to do anything but a MUST here, and being more precise about the requirements helps.
I've also made some changes to normative text. Specifically,