Subject: [quicwg/base-drafts] f5d2d1: Remove recommendation to not include tokens

From: Martin Thomson <[email-masked]>
Date: Thu, 10 Sep 2020 00:16:15 -0700

Branch: refs/heads/remove-new-token-forgery-req
  Home:   https://github.com/quicwg/base-drafts
  Commit: f5d2d1af76d9205883d89dc3fc20963883eb7b1a
      https://github.com/quicwg/base-drafts/commit/f5d2d1af76d9205883d89dc3fc20963883eb7b1a
  Author: Martin Thomson <[email-masked]>
  Date:   2020-09-10 (Thu, 10 Sep 2020)

  Changed paths:
    M draft-ietf-quic-transport.md

  Log Message:
  -----------
  Remove recommendation to not include tokens

This is another judgment call, but as this wasn't a MUST in the first
place, we weren't really preventing an attack.  This just removes the
recommendation to remove NEW_TOKEN tokens from Initial packets to new
server addresses.

It leaves the generic guidance, which is far more nuanced.

I've added some commentary about the effect of withholding tokens on
performance, as it seems like that is worth highlighting here.

All in all, this leans more toward saying that request forgery is not
the responsibility of QUIC deployments.

Closes #4076.