Update documentation around authentication requirements

[genehack]

And maybe consider making the server display a warning about auth not working if it's not running on port 5000 in non-production mode...