Update faq.html.md

clarify the note about --disable-security since it lives up to its name now and actually disables security