Documentation: clarify security implications and limitations

[rokroskar]

This refers specifically to the fact that the graph mutation endpoints are not secured. However, more generally, we should discuss in the documentation what sort of isolation is suggested for deployment.

Describe the following weaknesses:

• [ ] no https
• [ ] docker containers and their (non)isolation
• [ ] "demo" credentials and how to change them

[erbou]

Move to top of user documents.

[rokroskar]

I think this needs a proper section in the user/developer documentation.