Embedding of tokens

[PieterKas]

Opened as identity enthusiast, not as WIMSE co-chair.

Embedding of tokens always feels like a risky practice - e.g. embedded tokens may be "lifted" from the new token and replayed (think of embedding an access token in another token for example). Perhaps add something in the requirements to indicate some kind of requirement to embed tokens without enabling token replay theft?