docs-xml: document 'reject md5 clients'