Document database trustness/untrustness

[alokmenghrajani]

#182 is now fixed, but we should probably document that fact. Also, we assume the users table isn't used. I.e. #182 is fixed under the assumption that people are using ldap.