Merge pull request mendix#10447 from mendix/MvM-ClarifySecurityOfXAS

Clarify /xas/ security over HTTP

Author: MarkvanMents

content/en/docs/support/security-findings-faq.md

@@ -74,9 +74,9 @@ Hiding pages for end-users is not the way to restrict access to data, you should
 
 When an XPath query is received by the runtime, the runtime will always apply entity access to the XPath query, based on the access rules connected with the role (or roles) of the end-user making the request. So, although an end-user might be able to change the XPath query before sending it to the runtime, the runtime will still apply access rules, and only return data the end-user is allowed to access.
 
-### HTTP Verb Tampering
+### HTTP Message Tampering
 
-The `/xas/` request handler is not a RESTful API, so the conventions that you would usually apply to RESTful APIs, do not apply in this case. The `/xas/` API does not look at the HTTP verb used, this is ignored. Only published REST services make a distinction between HTTP verbs.
+The `/xas/` request handler is not a RESTful API, so the conventions that you would usually apply to RESTful APIs, do not apply in this case. The `/xas/` API does not look at the HTTP verb used, this is ignored. If the content of the HTTP message is altered, security restrictions continue to be applied server-side and the end-user will only see data which they have access to. See the example below.
 
 ### Example