Add docs and example for allowed_issuers setting.

syncserver.ini

@@ -37,9 +37,14 @@ public_url = http://localhost:5000/
 # only be used as a last resort and after careful checking of server config.
 force_wsgi_environ = false
 
+[browserid]
 # Uncomment and edit the following to use a local BrowserID verifier
 # rather than posting assertions to the mozilla-hosted verifier.
 # Audiences should be set to your public_url without a trailing slash.
-#[browserid]
 #backend = tokenserver.verifiers.LocalVerifier
 #audiences = https://localhost:5000
+
+# By default, syncserver will accept identity assertions issues by
+# any server. You can restrict this by setting the below to a list
+# of allowed issuer domains.
+#allowed_issuers = www.mysite.com myfriendsdomain.org