Document security implications of shield and basic auth

When you export the config the user and password are exported. People commit their config so you can end up with this information in your git and then on GitHub. Not only you can then bypass the shield, but people may use similar password for their admin account.

This is not a theoretical issue. A quick search on GitHub would prove it.

This module should follow a strict secure by design approach in my opinion.