add secure rules and document for web servers

An poorly configured twip instance may cause user authentication being leaked.
Users shoud be alerted with this.