Improve documentation of `tokenhosts`

I also have changed the default to localhost only. However, servers
which leave `exports.tokenhosts` undefined will continue to accept
all hostnames in assertions, so this commit will not break existing
servers that pull it.