Add alternative sid/client_secret authentication

proposals/1915-unbind-identity-server-param.md

@@ -57,8 +57,11 @@ should assume that the identity server doesn't support the `/unbind` API, unless
 it returns a specific matrix error response (i.e. the body is a JSON object with
 `error` and `errcode` fields).
 
-The identity server should accept any request to unbind a 3PID for a `user_id` from
+The identity server should authenticate the request in one of two ways:
-the homeserver controlling that user ID.
+
+1. The request is signed by the homeserver which controls the `user_id`.
+2. The request includes the `sid` and `client_server` params (as per `/bind`),
+   which proves ownership of the given 3PID.
 
 Example: