This seems to imply that if a file is provided here that will be used instead of the two files mentioned but in fact the code uses all 3 files with the secure-vars-file overriding the settings in the other two.  I would make that more obvious here.