security docs enhancements

This PR replaces #1397.
It's done here to hide the `userid=_marker` from the new signature in the docs. We do this in some other areas as well where a function has some extra arg used only for testing.