Default configuration is abusable by spam bots

[bones-was-here]

And the documentation makes no mention of setting up captcha or disabling registration.

• Poor experience for would-be homeserver admins who get exploited by automated bots as soon as their instance is discovered
• Creates work for matrix.org abuse team, and the moderators of other communities using matrix
• Increases the amount of system resources used by homeservers

[nakoo]

I also think it's important to mention using create-account command in INSTALL.md page. I found many users don't know the command either.

[S7evinK]

The example config now has registration disabled by default. We also verify that reCaptcha is enabled when enabling registration and fail to start if that's not the case.

create-account is now also added in the Getting started section.