document how to restrict a firewall to a specific host
[#2953][#2986] Tweaks to firewall hostname

Biggest change is to clarify that matching a firewall has no guarantee (is unrelated)
to whether or not access is restricted. Also, fixed up some of the regex.