Suggest the removal of setup/ for production

Neither test.php nor setup/ are actually needed for a production
setup to run properly. They represent a security threat:

 * test.php provides an attacker with sensitive data about the
   PHP setup and machine configuration;
 * setup/ embeds pog and a lot of sketchy code that would require
   an in-depth audit before we can trust it; moreover pog grants
   access to the database content and can truncate the tables.

The installing documentation should mention the removal of these
files.