docs: explain expectation for config in production

README.md

@@ -93,6 +93,10 @@ or from specific known client domains you can create an
 
 This can also be used to limit requests to specified endpoints.
 
+The default config is intended for running a local development 
+environment. For production it is expected that the config file 
+will exist with settings like the following:
+
 ```json
 {
   "cors": {
@@ -110,6 +114,9 @@ This can also be used to limit requests to specified endpoints.
 }
 ```
 
+This opens up the all endpoints except for the `/client` endpoint. 
+For now we expect client administration to be managed centrally. 
+
 #### Event bus 
 
 In your virtual environment: