Add documentation about disable_token_auth config setting