Clarify verifiable_password_authentication's description

As noted by @jasonrudolph in #377, this flag only describes whether _password_ login works over basic auth.