clarify help text for * in allowed_api-origins

Author: rouilj

roundup/configuration.py

@@ -1318,8 +1318,9 @@ def str2value(self, value):
 the origin value is scheme://host. There is no path
 component. So 'https://bar.edu/' would never be valid.
 Also the value * can be used to match any origin. Note that
-this setting allows any other web page to make requests against
-your roundup tracker and is not generally a good idea.
+this value allows any web page on the internet to make
+authenticated requests against your Roundup tracker and
+is not a good idea.
 
 You need to set these if you have a web application on a
 different origin accessing your roundup instance.