Several improvements

README.md

@@ -16,11 +16,25 @@ link; it should look like `https://cloud.example.test/s/SHARE_TOKEN`.
   position: "fullscreen_above",
   config: {
     shareUrl: "https://cloud.example.test/s/SHARE_TOKEN",
-    controlPath: "/MMM-NextcloudCookbook/control"
+    controlUrl: "http://mirror.example.test:8080/MMM-NextcloudCookbook/control"
   }
 }
 ```
 
+`controlUrl` is the complete address that should open when someone scans the QR
+code. Use the MagicMirror host name or IP address and port that your phone can
+reach. The module generates the QR image itself; it does not use an external QR
+code service.
+
+`controlUrl` is optional. When omitted, the module attempts to construct it
+from the address used to load MagicMirror. Set it explicitly when MagicMirror
+runs as an app or service using an address such as `localhost`, or when phones
+reach it through a different host name, port, or reverse proxy.
+
+When `controlUrl` is omitted, the module appends its default control path,
+`/MMM-NextcloudCookbook/control`, to the detected MagicMirror address. Most
+installations do not need to configure `controlPath` separately.
+
 For a password-protected public share, add `sharePassword`:
 
 ```js
@@ -30,16 +44,18 @@ config: {
 }
 ```
 
-MagicMirror sends module configuration to its browser clients. A public-share
-URL is normally appropriate there because the token is already a scoped share
-credential, but do not put a Nextcloud account password or app password in this
+Do not treat values in MagicMirror's `config.js` as private: someone who can
+load the MagicMirror display may be able to inspect them. A read-only public
+share URL is normally appropriate because its token is already limited to that
+share. Do not put a Nextcloud account password or app password in this
 configuration.
 
-For deployments that keep even the share token out of browser-visible
-configuration, set `SECRET_NEXTCLOUD_COOKBOOK_SHARE_URL` and, if needed,
+To keep even the share token out of the configuration delivered with the
+MagicMirror display, set `SECRET_NEXTCLOUD_COOKBOOK_SHARE_URL` and, if needed,
 `SECRET_NEXTCLOUD_COOKBOOK_SHARE_PASSWORD` in the MagicMirror process
 environment and omit the corresponding config values. Environment values take
-precedence over module configuration and are read only by `node_helper.js`.
+precedence over module configuration and are read only by `node_helper.js`. Read
+more here: https://docs.magicmirror.builders/configuration/secrets.html
 
 Open the controller at: