Part 2: Tidy up some of language about request objects

The introduction (7.1) contained some slightly ambiguous language that on first reading made me think that FAPI permitted request_uri to be hosted on the client.

It is already clear from section 7.2 that the request_uri must be hosted by the authentication server in the FAPI case, but I think it's worth tidying up the language in the introduction.

Also contains minor language/formatting improvements in the same area.