Trains are good for writing documentation :-)
Change -S semantics a bit.

If you specify no -S file, one will be made for you.

If you truly want no authentication of CLI connections, give an
empty -S argument  (-S "") and live with the warning that causes.

Use arc4random() for challenges and secrets, we want crypto strength.
Rely on the new default -S argument