Update security.rst

Hotfix: allow_if option might been added afterwards and seems to miss in the description above the list