clarify default access control policy

servers/slapd/slapd.conf

@@ -42,10 +42,11 @@ argsfile	%LOCALSTATEDIR%/slapd.args
 #	by users read
 #	by anonymous auth
 #
-# if no access controls are present, the default policy is:
-#	Allow read by all
+# if no access controls are present, the default policy
+# allows anyone and everyone to read anything but restricts
+# updates to rootdn.  (e.g., "access to * by * read")
 #
-# rootdn can always write!
+# rootdn can always read and write EVERYTHING!
 
 #######################################################################
 # ldbm database definitions