Make sure the security implication of subsites is clear in docs.