Add comment

lib/server.js

@@ -25,6 +25,11 @@ function Server(insecureAccess) {
   this._config = this._loadConfig();
   this._bridge = this._createBridge();
 
+  // Server is "secure by default", meaning it creates a top-level Bridge accessory that
+  // will not allow unauthenticated requests. This matches the behavior of actual HomeKit
+  // accessories. However you can set this to true to allow all requests without authentication,
+  // which can be useful for easy hacking. Note that this will expose all functions of your
+  // bridged accessories, like changing charactersitics (i.e. flipping your lights on and off).
   this._allowInsecureAccess = insecureAccess || false;
 }