Merge branch 'master' into plugin-2

lib/server.js

@@ -54,6 +54,11 @@ function Server(insecureAccess) {
     callback(this._config);
   }.bind(this));
 
+  // Server is "secure by default", meaning it creates a top-level Bridge accessory that
+  // will not allow unauthenticated requests. This matches the behavior of actual HomeKit
+  // accessories. However you can set this to true to allow all requests without authentication,
+  // which can be useful for easy hacking. Note that this will expose all functions of your
+  // bridged accessories, like changing charactersitics (i.e. flipping your lights on and off).
   this._allowInsecureAccess = insecureAccess || false;
 }