* when serialize-messages=on and allow-java-serialization=off
* one single config option to disable it completely * improve security documentation Co-authored-by: Patrik Nordwall <patrik.nordwall@gmail.com>