Make doc and error message more helpful when user attempts watchbucket on a non-service account