Network security documentation is out of date

[gcdev373]

user-guide/security.md

Still mentions tomcat, and doesn't really ram home the importance of protecting 8080 or explain how this could be done (nginx/docker/iptables/whatever).