add section about secure deployment

Author: chrismwendt

README.md

@@ -17,6 +17,17 @@ This extension is configured to talk to a language server over WebSockets. If yo
 private Sourcegraph instance, you should run your own language server. The server is available as a
 Docker image `sourcegraph/lang-python` from Docker Hub.
 
+### 🚨 Secure deployment 🚨
+
+We recommend deploying the language server behind an auth proxy or firewall and
+treating it like an authenticated user because anyone that connects to the
+language server can access resources such as private code that the language
+server has access to.
+
+Make sure you set `python.sourcegraphUrl` to the URL that the language
+server should use to reach Sourcegraph, which is likely different from the URL
+that end users use.
+
 ### Using Docker
 
 1. Run the Python language server Docker container:
@@ -41,15 +52,6 @@ Docker image `sourcegraph/lang-python` from Docker Hub.
     ip addr show docker0 | grep -Po 'inet \K[\d.]+'
     ```
 
-### Authentication proxies and firewalls
-
-Some customers deploy Sourcegraph behind an authentication proxy or firewall. If you do this, we
-recommend deploying the language server behind the proxy so that it can issue requests directly to
-Sourcegraph without going through the proxy. (Otherwise, you will need to configure the language
-server to authenticate through your proxy.) Make sure you set `python.sourcegraphUrl` to the URL
-that the language server should use to reach Sourcegraph, which is likely different from the URL
-that end users use.
-
 ## Known issues
 
 -   Dependencies are not installed. Hovers, definitions, and references only work for sources checked into the single repository you are viewing.