doc(readme): explain behavior of unset auth_tokens & delete_tokens

Just a clarification on how this works in the case of uninstalled tokens, for greater clarity and security

README.md

@@ -248,6 +248,8 @@ done
 
 Set `delete_tokens` array in [config.toml](./config.toml) to activate the [`DELETE`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/DELETE) endpoint and secure it with one (or more) auth token(s).
 
+The `DELETE` endpoint will not be exposed and will return `404` error if `delete_tokens` are not set.
+
 ```sh
 $ curl -H "Authorization: <auth_token>" -X DELETE "<server_address>/file.txt"
 ```
@@ -275,6 +277,11 @@ $ rustypaste
 
 You can also set multiple auth tokens via the array field `[server].auth_tokens` in your `config.toml`.
 
+> If neither `AUTH_TOKEN` nor `[server].auth_tokens` are set, the server will not require any authentication.
+> 
+> Exception is the `DELETE` endpoint, which requires at least one token to be set. See [Delete file from server](#delete-file-from-server) for more information.
+
+
 See [config.toml](./config.toml) for configuration options.
 
 #### List endpoint