Add docs for security models (#9)

- Change default security to CONFIGURE_ME
- Fix log on return URL handling
- Update INSTALLING security model descriptions

src/public/user/log-on.php

@@ -8,7 +8,7 @@ Security::verifyUser($db, redirectIfAnonymous: false);
 if (array_key_exists(Key::USER_ID, $_SESSION)) frc_redirect('/');
 
 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
-    Security::logOnUser($_POST['email'] ?? '', $_POST['password'], $_POST['returnTo'], $db);
+    Security::logOnUser($_POST['email'] ?? '', $_POST['password'], $_POST['returnTo'] ?? null, $db);
     // If we're still here, something didn't work; preserve the returnTo parameter
     $_GET['returnTo'] = $_POST['returnTo'];
 }