the paren was in the wrong place!

It was getting hard to format this properly in the list

It seems `baseUrl` got replaced by `baseURL` recently. Additionally,
let's use the HTTP URL, which hugo tells me to use anyway.

Our previous configuration did not actually check the server's x509
certificate, which is a serious flaw. `encrypt` is nice because it
enforces *some* TLS, but is vulnerable to trivial active MITM attacks
by anyone with an OpenSSL installation.

Also expand the documentation on the security level stuff to clarify
why we might want to use it.

term