Document mutable vs. immutable bundles, bundle names and security considerations

[dragetd]

Basically a reminder for #57 . While security works, it still has effects on how bundles are handled.

I would suggest in the docs to do it like we do it: Reusing bundle names is a feature and OK, but under one URL the bundle should not change. New bundle -> new URL. This needs to be documented.