access: bootstrap users only

The first users come only from --bootstrap-users; the genesis node
warns of htpasswd users that aren't among them.

Auth plan M1.

2 files changed, 11 insertions, 7 deletions

diff --git a/docs/access.md b/docs/access.md
index 7a85c94..519113c 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -34,9 +34,12 @@ password hashes: every member reads the document).
 
 A swarm gets a registry from its start if its genesis node is given its first users,
 `--bootstrap-users`: it records them, with the swarm ID, in its first change, each with
-everything (`[]` and `["_continuum"]`), and the other users of its `--htpasswd` with
-`[]`. Without it, the swarm has no registry, and is as swarms were before: users all
-alike (An existing swarm, below), until someone gives it one.
+everything (`[]` and `["_continuum"]`). Other users, of its `--htpasswd` or any node's,
+may do nothing until added (the genesis node warns of those of its `--htpasswd`).
+Without it, the swarm has no registry, and is as swarms were before: users all alike
+(An existing swarm, below), until someone gives it one. `--protocol-writers` counts in
+both: without a registry, as who may write protocol data; with one, to set it right
+should nobody be left who may manage users (Keeping the swarm manageable, below).
 
 ## At the HTTP API
 
diff --git a/docs/example.toml b/docs/example.toml
index e48bd2c..b98752d 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -83,13 +83,14 @@ htpasswd = "/etc/continuum/htpasswd"
 # (remake records, members, forget records), e.g. to repair a stuck remake, in a swarm
 # without a user registry. Such writes act on the whole swarm and are logged. Epoch
 # metadata and the swarm ID are never writable. With a registry its capabilities decide
-# instead (docs/access.md).
+# instead (docs/access.md), but for a registry nobody may manage users of any more: then
+# these may do everything on this node, to set it right.
 # protocol-writers = ["alice"]
 
 # With genesis: give the new swarm a user registry (docs/access.md), these its first
-# users, each may do everything, protocol data and managing users included; htpasswd's
-# other users may read and write the swarm's data. Unset, the swarm has no registry: its
-# users are all alike, and only those in protocol-writers write protocol data.
+# users, each may do everything, protocol data and managing users included; other users
+# may do nothing until added. Unset, the swarm has no registry: its users are all alike,
+# and only those in protocol-writers write protocol data.
 # bootstrap-users = ["alice"]
 
 # How log lines look: text (timestamped), journal (for systemd's journal: no timestamp or