Doc security

There is room for improvement, but this covers what I felt was omitted that lead to my confusion regards security.