Clarify new default security model for apache 2.4