Remove vhost mention in docs, it implies something that's not right.

With the vhost paragraph, it looks like vhosts are an alternative to
per-user permissions, when in fact they are an integral mechanism in
permissions, which, as far as I can tell, are per-user always.