Merge pull request #3463 from bobbypage/webui_note

Add note about WebUI auth

Author: bobbypage

docs/web.md

@@ -10,6 +10,8 @@ This UI has one primary resource at `/containers` which exports live information
 
 You can add authentication to the web UI by either HTTP basic or HTTP digest authentication. 
 
+NOTE: The Web UI authentication only protects the `/containers` endpoint, and not the other cAdvisor HTTP endpoints such as `/api/...` and `/metrics`. Some of these endpoints can expose sensitive information, so it is not advised to expose these endpoints publicly.
+
 ### HTTP basic authentication
 
 You will need to add a *http_auth_file* parameter with a HTTP basic auth file generated using htpasswd to enable HTTP basic auth. By default the auth realm is set as localhost.