doc(readme): explain behavior of unset auth_tokens & delete_tokens

Just a clarification on how this works in the case of uninstalled tokens, for greater clarity and security

README.md

@@ -252,6 +252,8 @@ Set `delete_tokens` array in [config.toml](./config.toml) to activate the [`DELE
 $ curl -H "Authorization: <auth_token>" -X DELETE "<server_address>/file.txt"
 ```
 
+> The `DELETE` endpoint will not be exposed and will return `404` error if `delete_tokens` are not set.
+
 ### Server
 
 To start the server:
@@ -275,6 +277,11 @@ $ rustypaste
 
 You can also set multiple auth tokens via the array field `[server].auth_tokens` in your `config.toml`.
 
+> If neither `AUTH_TOKEN` nor `[server].auth_tokens` are set, the server will not require any authentication.
+> 
+> Exception is the `DELETE` endpoint, which requires at least one token to be set. See [Delete file from server](#delete-file-from-server) for more information.
+
+
 See [config.toml](./config.toml) for configuration options.
 
 #### List endpoint