Need to specify CanMakePaymentEvent.respondWith() behavior

[romandev]

We already added CanMakePaymentEvent to our spec but missed respondWith()'s behavior. In general, we understand how it works, but we need to define in more details in terms of spec. Otherwise, it might make some security holes.

[stpeter]

@romandev What are the security issues? It's always good to document those so we can add them to security considerations section of the spec, and demonstrate the mitigations.