document config option and HTTPS required by default