config: Explicitly mention that the CGI pages disclosing the ca-password can be blocked