Docs: Confirm what happens when you turn on authorization without an auth plugin

I tested this.
Docs: Clear up remaning todos in client config