Uniquely addressable requirement for OOB authenticators

[jimfenton]

Although the introductory text to section 5.1.3 says, "An out-of-band authenticator is a physical device that is uniquely addressable...," section 5.1.3.1 says, "The out-of-band device SHOULD be uniquely addressable..."

In order to function as a proxy for "something you have", the out-of-band device has to be uniquely addressable. Accordingly, the requirement in 5.1.3.1 should read, "SHALL be uniquely addressable."