NEW_TOKEN token should be encrypted

[Kazuho Oku <[e-mail]>]

As stated in https://github.com/quicwg/base-drafts/issues/2543, my
understanding is that a token sent in a NEW_TOKEN frame SHOULD be
encrypted. The only exception would be the case of the token carrying
only an opaque and randomly-generated key identifier in a stateful
design (i.e. a server using a key-value store to retain the
information of previous connections).

Otherwise, an observer can use the information contained in the token
sent in an resuming connection, to correlate that connection to the
previous connection that issued the token. For example, if a server
includes the generation time of the token in plaintext, an observer
can extract that information found in an Initial packet to nail down
the connection that issued the token.

While I think we might be call this an editorial issue, I think we
should clarify this as a normative requirement (e.g., SHOULD). Hence
bringing the discussion to the mailing list as well.

-- 
Kazuho Oku