fix security caution for 'remote' setting (was 'xmlrpc')
replace preset _cautionList property with _caution config metadata parameter, plugins can now easily set cautions on their settings