More normative language issues

From chrisn: 

I'm now wondering about this:

> it SHOULD not be possible for a site to mutate a codec input or output 

given the spec includes mitigations as part of the normative requirements. Also, we should probably add "This section is non-normative." to both these sections.