diff --git a/pubsubhubbub-core-0.4.xml b/pubsubhubbub-core-0.4.xml
index bb21681..d918d6c 100644
--- a/pubsubhubbub-core-0.4.xml
+++ b/pubsubhubbub-core-0.4.xml
@@ -105,7 +105,7 @@
Hubs MUST ignore additional request parameters they do not understand.
Hubs MUST allow subscribers to re-request subscriptions that are already activated. Each subsequent request to a hub to subscribe or unsubscribe MUST override the previous subscription state for a specific topic URL and callback URL combination once the action is verified. Any failures to confirm the subscription action MUST leave the subscription state unchanged. This is required so subscribers can renew their subscriptions before the lease seconds period is over without any interruption.
- The topic and callback URLs MAY use HTTP or HTTPS schemes. The topic URL MUST be the one advertised by the publisher in a Self Link Header during the discovery phase. (See ). Hubs MAY refuse subscriptions if the topic URL does not correspond to the one advertised by the publisher. The topic URL can otherwise be free-form following the URI spec. Hubs MUST always decode non-reserved characters for these URL parameters; see section 2.4 on "When to Encode or Decode" in the URI spec.
+ The topic and callback URLs MAY use HTTP or HTTPS schemes. The topic URL MUST be the one advertised by the publisher during the discovery phase. (See ). Hubs MAY refuse subscriptions if the topic URL does not correspond to the one advertised by the publisher. The topic URL can otherwise be free-form following the URI spec. Hubs MUST always decode non-reserved characters for these URL parameters; see section 2.4 on "When to Encode or Decode" in the URI spec.
The callback URL MAY contain arbitrary query string parameters (e.g., ?foo=bar&red=fish). Hubs MUST preserve the query string during subscription verification by appending new parameters to the end of the list using the & (ampersand) character to join. Existing parameters with names that overlap with those used by verification requests will not be overwritten. For event notification, the callback URL will be POSTed to including any query-string parameters in the URL portion of the request, not as POST body parameters.